Joplin Server CVE-2026-105786

Requires a Joplin Server (self-hosted sync server) deployment running a version prior to 3.7.13. The attacker does not need credentials, but exploitation depends on an already-authenticated victim being lured into approving the attacker's chosen application authorization identifier on the generic consent page (the vulnerable POST to applications/:id/confirm was public and lacked CSRF/session binding). Limiting factors: the victim must be logged in and must actively approve the consent (UI:A/UI:R), so success depends on social engineering or a cross-site request against an authenticated session rather than fully silent unauthenticated exploitation; no non-default configuration is otherwise required.

This is a genuine high-priority issue rather than a CVSS-inflated paper risk, but its exploitation is conditional. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity, unauthenticated attacker who nevertheless requires active victim interaction - the logged-in victim must approve the attacker's chosen application authorization identifier on the consent page. CWE-306 (missing authentication for a critical function) is consistent with the source diff, which shows the authorizing POST to applications/:id/confirm was publicly reachable and lacked a CSRF/session binding, so a cross-site request could authorize an application for a logged-in user. Technical impact is high (VC:H/VI:H): successful exploitation yields a victim session with full read and write access to synchronized notes, effectively account takeover of sync data, with no availability impact (VA:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so the automated-exploitation and widespread-exploitation signals are absent; the realistic risk therefore hinges on social-engineering the victim into approving the consent page rather than on mass unauthenticated exploitation. No SSVC decision data was supplied. The reliance on UI:A (user interaction) is the single largest mitigating factor against the otherwise network-unauthenticated profile.

An attacker targeting a Joplin Server instance generates an application authorization identifier under their control and sends a logged-in victim a crafted link (or cross-site request) to the generic consent page. The victim approves the attacker's identifier, after which the attacker redeems a durable application ID and password and exchanges it for a victim session, gaining full read/write access to the victim's synchronized notes. No public exploit identified at time of analysis, though the fix PR and commit disclose the exact mechanism.