3.1 KiB
outline — triage (pin outlinewiki/outline:1.10.1; sidecars postgres:18-alpine, redis:7-alpine not in scope)
Template auth: NO SSO configured (no AZURE_/DISCORD_/OIDC_/GOOGLE_/SLACK_/GITLAB_ env). Sign-in = e-mail magic link
(login_kind: email) + passkeys. Gates: setup_gate: true only (public behind Outline's own login after setup). One workspace per box.
Notices (12 GHSA + 1 release hit)
| id | sev | verdict | login | reachable |
|---|---|---|---|---|
| GHSA-f28f-75h4-499q | critical | NOT-A-FINDING: Azure SSO callback only; template configures no Azure provider | - | no |
| GHSA-m9vh-j2wc-xj24 | high | NOT-A-FINDING: Azure/Discord OAuth adapters only; neither configured | - | no |
| GHSA-48rq-wx9j-g949 | critical | NOT-A-FINDING: needs 2+ OAuth/OIDC providers on one team; template has none (email+passkey do not use providerId rows) | - | no |
| GHSA-27h6-gg7j-wj5w | medium | NOT-A-FINDING: GitLab integration plugin; not configured, and cross-tenant needs a 2nd workspace | - | no |
| GHSA-x4w3-9p9j-cprh | low | NOT-A-FINDING: cross-TEAM user-id oracle; a box runs one workspace | - | no |
| GHSA-97vv-f6qq-6842 | high | REAL (<1.11.0): write API key/OAuth token can register passkey / change e-mail -> takeover | needs a victim's leaked write token | yes |
| GHSA-w8vg-8mjx-xq8x | high | REAL (<1.11.0): logged-out JWT keeps collab websocket | any user (stolen session) | yes |
| GHSA-65xg-84g9-7hrm | medium | REAL (<1.11.0): collab socket writable after archive/delete | any user | yes |
| GHSA-rq53-m97j-f2pg | high | REAL (<1.12.0): unpublished doc's public share keeps working, cannot be revoked | none (holder of an old share link) | yes — public share links are used (our guide teaches "Publish to web") |
| GHSA-h6ff-rw9x-5mq2 | medium | REAL (<1.12.0): member publishes into private collection | any user | yes |
| GHSA-rvj7-2gww-6xfq | low | REAL (<1.12.0): shares.info leaks private collection name/path | none (share link holder) | yes |
| GHSA-cprf-crfh-w3p4 | low | REAL (<1.12.0): e-mail sign-in token replayable within 10 min from same IP | none (needs the link + same IP) | yes — e-mail sign-in is OUR login method |
| release:v1.12.0 | - | REAL: image Node.js upgraded to 26.12.1 (Node security release); Outline runs on Node at runtime | - | - |
Real 8 / 13. Worst real: high (97vv, w8vg, rq53). rq53 needs no login.
Fix
Smallest fixing all real: 1.12.0. TARGET: outlinewiki/outline:1.12.0 (newest stable; Docker Hub tags 1.12.0 / 1.12 / latest seen; no 1.12.x patch yet). Same main (1): yes.
Breaking/migrations 1.10.1 -> 1.12.0 (read v1.11.0, v1.12.0; v1.12.0 full body via API): none found. Notes: v1.12.0 "Migrations before v1.3.0 compacted into a baseline schema" (irrelevant from 1.10.1); app-run DB migrations; new personal-documents feature; "authentication requirements on account settings routes tightened" (1.11.0). No env renames, no new required service.
Lane: SECURITY_FIX.
Classifier note: the 5 SSO/GitLab/cross-team notices are config-dependent; classifier cannot know — fine to list, but it should not count Azure/Discord/OIDC/GitLab notices as "critical for the box" without a template-env check.