CVE-2026-55210: Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's isexternal flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Joplin Server deployments that use both local authentication and SAML authentication are exposed if a local account’s email can be asserted through the identity provider. The affected behavior applies to versions before 3.7.2.
What does an attacker need to exploit the vulnerability?
An attacker needs an IdP session capable of asserting the email address of a local Joplin user. They can then submit a request to POST /api/saml and obtain a session for that local account without knowing its local password.
What access could an attacker gain?
The attacker can access or modify the targeted user’s notes, files, and settings through the authenticated session created for the local account.
How can the issue be remediated?
Upgrade Joplin Server to version 3.7.2, which fixes the missing is_external check during SAML SSO login.