CVE-2026-55179: Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Joplin Server user can exploit it if they obtain or guess the internal server ID of another user's item. No additional privileges or user interaction are required.
Which data is exposed?
The affected content route can return another user's note or item content. Items protected by end-to-end encryption are not readable through this issue unless their content is not encrypted.
Are default deployments affected?
The issue affects Joplin Server versions prior to 3.7.2 because the vulnerable GET /items/:id/content route does not enforce ownership or access authorization for the supplied item ID.
How can this be remediated?
Upgrade Joplin Server to version 3.7.2, which fixes the missing authorization check.