This is a complete authorization bypass, not a minor information disclosure. The CVSS 5.8 score fundamentally misrepresents the severity by treating heading disclosure as a contained leak rather than what it is: an architectural failure that eliminates the access control layer entirely. An attacker querying /api/storage/getOutlineStorage for any document identifier walks through a door that should never have opened.
The endpoint accepts a document identifier and returns the document's heading structure without verifying the requesting user has access to that document. That's not a flawed disclosure mechanism — it's a missing authorization guard. The CVSS rubric treats this as information disclosure because the response contains outlines rather than full content, but from an access control perspective, the authorization plane has failed completely.
The real risk isn't one outline leaked — it's enumeration at scale. There's no evidence of rate limiting on this endpoint, no described audit trail correlating the querying user to the document ID requested, and no indication the server logs which documents users are probing. One compromised account becomes a reconnaissance oracle that maps an entire workspace's structural hierarchy: which documents exist, what topics cluster together, where sensitive content lives — all without touching actual content. Heading identifiers often expose document intent, classification, or workflow state ('Q4 Financials - Confidential', 'HR: Termination Checklist'). That's strategic intelligence, not incidental metadata.
The EPSS score of 0.00194 is honest about external exploitability but blind to the actual threat model. This requires authenticated access — so it's not a P0 external exposure. It's a P0 internal threat: lateral movement infrastructure for a compromised account, shared workspace participant, or malicious insider. The metric can't capture credentialed exploitation because there's no external signal to measure.
Check whether the /api/storage/getOutlineStorage endpoint validates the caller's document permissions. If not, that's the immediate gap. Assume every endpoint returns sensitive data until proven otherwise — auxiliary metadata endpoints are where access control models consistently fail. Review server logs to confirm whether document ID queries are being correlated with requesting users; if not, exploitation is invisible. The fix isn't just adding an auth check — it's treating document outlines as first-class security objects with their own sensitivity model.