CVE-2026-105786: Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/applicationauth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joplinto a version that resolves this vulnerability.Fixed in 3.7.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Joplin Server deployments running a version prior to 3.7.13 are affected. The vulnerable flow includes a public application-authentication endpoint and does not require the attacker to authenticate.
What must an attacker do to take over an account?
The attacker must get a logged-in victim to approve an attacker-chosen application authorization identifier through the generic consent page. The attacker can then redeem the resulting durable application ID and password for a victim session with full read and write access to synchronized data.
Is user interaction required?
Yes. The victim must approve the attacker’s identifier in the application consent flow; the supplied CVSS vector identifies this as requiring user interaction.
How can the issue be remediated?
Upgrade Joplin Server to version 3.7.13, which fixes the vulnerability.