CVE-2026-120489 — Outline before 1.12.0: Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Outline versions before 1.12.0 contain an incorrect authorization vulnerability that allows authenticated members to publish documents into private collections without write access.