Joplin Server: Account takeover via attacker-chosen application authorisation ID
Summary
Joplin Server before 3.7.13 accepts an application authorisation identifier chosen by the caller and binds it to a logged-in user through a consent page. The redemption endpoint issues an application ID and password without authenticating the redeemer. An attacker who tricks a victim into approving the attacker's identifier can obtain a durable application credential and exchange it for a session with full read and write access to synchronised notes.
Affected
- Joplin Server (packages/server) versions before 3.7.13
- Desktop and mobile clients are not affected as such; the risk is in the server-side endpoint
Fixed in
- Upgrade to Joplin Server 3.7.13 or later (current 3.7.x release recommended)
Workaround
- Unknown.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- No evidence of exploitation in the wild found in the sources reviewed.
- Victim interaction (approval of a consent prompt) is required.
Our recommendation
- Upgrade any self-hosted Joplin Server to 3.7.13 or later.
- Check whether the server is reachable from the internet and restrict access if it is not needed.
- Review application passwords and active sessions for unknown entries.
- Review server logs for unexpected application authorisation activity.
- Inform users not to approve unexpected authorisation requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-435m-gr6q-2fg6 github.com
- Fix commit 1a0a50a github.com
- Pull request #16270 github.com
- Joplin release v3.7.13 github.com
- OSV entry CVE-2026-105786 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:26.
Original description (NVD)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.
NVD references (5)
- https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00
- https://github.com/laurent22/joplin/pull/16270
- https://github.com/laurent22/joplin/releases/tag/v3.7.13
- https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6
- https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.