Skip to content
OpenAdvisories
High WID-SEC-2026-3298 15 CVEs

Joplin: Mehrere Schwachstellen

Published Sep 9, 2026 · Updated Oct 5, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Joplin ausnutzen, um Benutzerkonten zu übernehmen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Joplin ist eine quelloffene Notiz- und Aufgabenverwaltungsanwendung.

Vulnerabilities 15

  • Critical 9.1
    CVE-2026-46649

    Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without app…

    laurent22 joplin
  • High 8.0
    CVE-2026-105783

    Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Cont…

    laurent22 joplin
  • High 7.7
    CVE-2026-55105

    Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output witho…

    laurent22 joplin
  • High 7.6
    CVE-2026-59814

    Joplin: Stored XSS via inline-served note attachment on published shares

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Dispositio…

    laurent22 joplin
  • High 7.4
    CVE-2026-55210

    Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_exter…

    laurent22 joplin
  • High 7.1
    CVE-2026-49450

    Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater…

    laurent22 joplin
  • High 7.0
    CVE-2026-49453

    Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator character…

    laurent22 joplin
  • Medium 6.5
    CVE-2026-55179

    Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied in…

    laurent22 joplin
  • Medium 4.8
    CVE-2026-105785

    Joplin Server password reset accepts tokens issued for unrelated purposes

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without…

    laurent22 joplin
  • Medium 4.6
    CVE-2026-105784

    Joplin whiteboard card rendering allows CSS injection into application chrome

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEdito…

    laurent22 joplin
  • Medium 4.4
    CVE-2026-46650

    Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript…

    laurent22 joplin
  • Medium 4.3
    CVE-2026-59815

    Joplin: Pending share recipients can write items into shared folders before accepting invitations

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, wit…

    laurent22 joplin
  • Medium 4.3
    CVE-2026-59816

    Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instan…

    laurent22 joplin
  • Low 2.5
    CVE-2026-49449

    Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href …

    laurent22 joplin
  • Unscored —
    CVE-2026-55456 Rejected

    This CVE is a duplicate of another CVE.

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-105783, EUVD-2026-92870, CVE-2026-105784, EUVD-2026-92871, CVE-2026-105785, EUVD-2026-92872

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-84172, EUVD-2026-84171, EUVD-2026-84170, EUVD-2026-84169, EUVD-2026-84168, EUVD-2026-84167, EUVD-2026-84174, EUVD-2026-84180, EUVD-2026-84176, EUVD-2026-84177, EUVD-2026-84166

  3. #1

    Initiale Fassung

References