CVE-2026-120489

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.12.0

Description An incorrect authorization issue exists in the authorizeDocumentPublish() function. This allows authenticated members to publish documents into private collections even if they lack write access. The process involves detaching a child document through the documents.unpublish endpoint while retaining the parentDocumentId, followed by calling the documents.update endpoint using a private collection UUID to inject phishing content.

Recommendations Update to version 1.12.0 or later.