CVE-2026-105785: Joplin Server password reset accepts tokens issued for unrelated purposes
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Which deployments are affected?
Joplin Server versions prior to 3.7.2 are affected. The vulnerable path is the public password-reset endpoint, so it may be reachable remotely where that endpoint is exposed.
What does an attacker need to exploit this issue?
The attacker needs to obtain a victim's CSRF token, account-confirmation token, or email-change token through a separate disclosure channel. They can then submit that token to reset the victim's password; no existing account privileges or user interaction are required.
What is the impact after a successful password reset?
An attacker can replace the victim's password and take over access to the account. The reset also deletes the victim's existing sessions and API applications.
What should teams do if they cannot immediately upgrade?
The provided information identifies upgrade to Joplin Server 3.7.2 as the fix. Until then, treat disclosure of CSRF, account-confirmation, and email-change tokens as potentially enabling password resets and investigate affected accounts accordingly.