PT-2026-118471

CVE-2026-113611

Published

2026-10-20

Updated

2026-10-23

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.8.0

Description An improper access revocation issue exists where deleted administrators continue to receive document contents. This occurs because the UserDeletedProcessor fails to disable WebhookSubscription rows. Consequently, former administrators who registered webhooks before their account deletion continue to receive full document bodies, including Markdown and Yjs data, via the DeliverWebhookTask for every matching workspace event.

Recommendations Update to version 1.8.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sanjorn Keeratirungsan

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers