Joplin Desktop CVE-2026-105783

Exploitation requires the opt-in Web Clipper server (packages/lib/ClipperServer.ts) to be explicitly enabled in Joplin Desktop - it is off by default, which is the single biggest limiter. Given that, the attacker needs only to get the victim to open a crafted web page in a browser on the same machine while Joplin is running; the vulnerable server accepts any http/https origin (Access-Control-Allow-Origin:*) at the POST /auth and GET /auth/check pairing endpoints. The final gating condition is user interaction: the victim must approve the desktop confirmation dialog, which fails to display the requesting origin, so an unwary user may authorize the attacking page. Limiting factors therefore are: non-default Web Clipper configuration, required local browsing context, and mandatory victim approval of the pairing prompt (UI:R, AC:H).

This is a genuine but conditional priority, not an inflated high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, 8.0) correctly captures the shape of the flaw: a remote, unauthenticated attacker (PR:N) exploits it over the network via a malicious web page, but success depends on conditions outside the attacker's control (AC:H) and on the victim performing an action (UI:R) - approving the pairing dialog. The scope change (S:C) and C:H/I:H reflect that a stolen permanent API token yields ongoing read/write to all notes, folders, tags, resources, and master keys. No EPSS score, KEV listing, or public exploit was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The most important limiting signal is that the Web Clipper server is opt-in (disabled by default), which - combined with AC:H and UI:R - means real-world exposure is far narrower than the 8.0 base score alone suggests. The counterweight is that the attack is fully remote and the confirmation dialog's failure to show the requesting origin makes the social-engineering step realistic for a victim who has Web Clipper enabled. Overall: prioritize patching for environments that knowingly enable Web Clipper; de-prioritize for the default-configuration majority.

A victim running Joplin Desktop with the opt-in Web Clipper server enabled visits an attacker-controlled web page. Because the server returns Access-Control-Allow-Origin:* and does not reject http(s) origins, the page silently calls POST /auth and, when the victim approves the generic confirmation dialog that never names the requesting origin, polls GET /auth/check to harvest the permanent API token. No public exploit is identified at time of analysis, though the technique is straightforward JavaScript against a fixed localhost port.