CVE-2026-59815: Joplin: Pending share recipients can write items into shared folders before accepting invitations
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Joplin Server deployments running versions before 3.7.7 are affected when folder sharing is used and a user has a pending invitation to a shared folder.
What does an attacker need to exploit this issue?
The attacker must be an authenticated, low-privileged user who has been invited to a shared folder but has not accepted the invitation. No user interaction is required after the pending invitation exists.
What is the impact of successful exploitation?
An attacker can create content under the shared folder's share ID before accepting the invitation. That injected content is propagated to the folder owner and users who have accepted the share.
What remediation is available?
Upgrade Joplin Server to version 3.7.7, which fixes the authorization check.