Read the docs
TI-2026-68387 Aliases CVE-2026-105786

Unauthenticated account takeover in Joplin via app authorization

Priority HIGH 72CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Joplin versions before 3.7.13 are affected. The application authorization flow lets a caller choose the identifier, and the redeem endpoint issues a durable application ID and password without authenticating the redeemer. An unauthenticated remote attacker can trick a logged-in user into approving that identifier, then exchange the credential for a session with full read and write access to synchronized data. The flaw is missing authentication for a critical function (CWE-306).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed joplin (laurent22): 3.7.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
laurent22joplinbefore 3.7.133.7.13Patch availableCNA
  • joplin Vendorlaurent22 Affected before 3.7.13 Fixed in 3.7.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:*——laurent22
  • cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:* Versions — — ·laurent22

Remediation

Upgrade Joplin to version 3.7.13, which fixes this vulnerability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA joplin (laurent22) Fixed in 3.7.13

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105786
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → HIGH

References

Other 4

  • TI-2023-24472 Arbitrary code execution on click of PDF links in Joplin CVSS 3.1CRITICAL 9.0
  • TI-2024-32950 Remote Code Execution on click of <a> Link in markdown preview CVSS 3.1CRITICAL 9.6
  • TI-2024-27054 Joplin has a parsing error leading to Cross-site Scripting (XSS) CVSS 3.1CRITICAL 9.7
  • TI-2026-34297 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint CVSS 4.0CRITICAL 9.1
  • TI-2025-17795 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin CVSS 3.1CRITICAL 9.6
  • TI-2025-19991 Privilege escalation in Joplin server via user patch endpoint CVSS 3.1HIGH 8.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences