Event Access Insecure Direct Object Reference (IDOR)

Summary

The events.list API endpoint contains an IDOR vulnerability allowing users to view events for any actor or document within their team without proper authorization. While the code implements team-level isolation (via teamId check) and collection-level authorization, it fails to validate access to individual events. An attacker can manipulate the actorId or documentId parameters to view events they shouldn't have access to. This is particularly concerning since audit log events might contain sensitive information (e.g. document titles).

PoC

Using a read-only viewer account, perform the following HTTP request:

POST /api/events.list HTTP/1.1
Host: local.outline.dev:3000
Cookie: 
Content-Type: application/json

{
  "actorId": "10590947-466a-401b-b9f7-4b514a194257"
}

Make sure to change the user's UUID. The user's identifier can be accessed by a low-privileges user using the "Members" section (/api/users.list).

Impact

Disclosure of audit trails information, including document changes (eg. Title) and operations.

Please note that this issue was identified by GeckoSecurity AI (https://www.gecko.security/), and manually reviewed by Doyensec (https://doyensec.com/) during a tools comparison exercise.