Joplin Desktop: Cross-origin theft of API token via Web Clipper pairing
Summary
Joplin Desktop with the opt-in Web Clipper server enabled allowed arbitrary websites to call the pairing endpoints /auth and /auth/check, because web (HTTP and HTTPS) origins were not rejected. If a victim approves the generic confirmation prompt, the attacking web page receives the permanent API token, which grants ongoing read and write access to notes, folders, tags, resources and master keys.
Affected
- Joplin Desktop versions before 3.7.13
- Web Clipper server feature enabled (opt-in)
Fixed in
- Fixed in Joplin Desktop 3.7.13
Workaround
- Unknown. No workaround is documented by the vendor; disable the Web Clipper service where it is not needed.
Exploitation
- Not marked as known exploited.
- No public proof of concept or in-the-wild reports found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory Joplin Desktop installations and update to version 3.7.13 or later (check the releases page for the current stable version).
- Disable the Web Clipper service on workstations that do not need it.
- After updating, review paired clippers and regenerate the API token if a suspicious pairing was approved.
- Instruct staff not to approve pairing prompts they did not initiate.
- Monitor the vendor advisory GHSA-9728-v7ww-mxjv for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 27ae5c0 (Restrict Web Clipper pairing to extension origins) github.com
- Pull request #16276 github.com
- Joplin release v3.7.13 github.com
- GitHub Security Advisory GHSA-9728-v7ww-mxjv github.com
- OSV entry CVE-2026-105783 osv.dev
- VulnRichment CVE-2026-105783 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:32.
Original description (NVD)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.