← Back to the live CVE advisory feed

CVE-2026-105786: joplin

Severity

8.5 (HIGH)

Vendor

LAURENT22

Affected versions

< 3.7.13

Fixed version

3.7.13.

Patch status

Patched

Published

2026-10-06T00:16:34.283

Modified

2026-10-06T00:16:34.417

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

View the official NVD record for CVE-2026-105786

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.