PT-2026-52499 · Outline · Outline
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Outline versions prior to 1.8.0
Description
An authorization bypass exists due to a path parsing discrepancy. The
AuthenticationHelper.canAccess() function uses ctx.originalUrl to verify if an API key or OAuth token possesses the necessary scopes for a request by extracting the last segment of the URL. However, the function does not strip the URL fragment (#). Since the Koa router utilizes ctx.path (which removes the fragment) for routing, an attacker can append a fragment containing a permitted path to a restricted endpoint. This causes the router to direct the request to the restricted endpoint while the canAccess() function validates the permitted path within the fragment, leading to privilege escalation.Recommendations
Update to version 1.8.0.
Exploit
Fix
LPE
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Outline