What is the CVSS score of CVE-2026-34600?

CVE-2026-34600 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34600?

Yes, a patch is available for CVE-2026-34600. Update the affected software to the latest version immediately.

Joplin CVE-2026-34600

EUVD-2026-31001 MEDIUM

Improper Preservation of Permissions (CWE-281)

2026-05-19 GitHub_M

Information Disclosure Joplin

5.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 23:31 vuln.today

Analysis Generated

May 19, 2026 - 23:31 vuln.today

Patch available

May 19, 2026 - 23:02 EUVD

DescriptionGitHub Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289. In ChangeModel.delta, when DELTA_INCLUDES_ITEMS is enabled (the default), the latest state of items is attached to delta output without verifying that those items are still shared with the requesting user, and the existing removal logic only filters items deleted for all users. Additionally, the change compression logic incorrectly reduces create - delete to NOOP, which is unsafe because compression is applied per page and an item can have multiple create events; if an earlier create falls on a separate page from a later create -> delete pair, the deletion is dropped and the sequence collapses to a create. As a result, the delta API returns a create event for a deleted item with the full latest content attached, exposing notes the user no longer has access to. This issue has been fixed in version 3.5.3.

AnalysisAI

Unauthorized note disclosure in Joplin server versions 3.5.2 and prior allows authenticated former share recipients to retrieve notes after sharing has been revoked, via two compounding logic errors in the ChangeModel delta API. The first flaw attaches full item content to delta responses without re-verifying current share status; the second incorrectly compresses create → delete event sequences into a NOOP rather than a delete, causing the API to synthesize a create event with full note content for deleted items when those events span separate delta pages. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but confidentiality impact is rated High given that full note content is returned to unauthorized recipients.

Technical ContextAI

Joplin's server component exposes a delta synchronization API (ChangeModel.delta) that clients use to pull incremental state updates. The vulnerability has two root causes traceable to CWE-281 (Improper Preservation of Permissions). First, when the DELTA_INCLUDES_ITEMS flag is enabled - the server default - the latest item state is eagerly attached to delta output, but this attachment skips a share-membership check: the existing removal logic only filters items deleted for all users, not items whose share with the requesting user was revoked. Second, the change compression routine that collapses redundant delta events applies create → delete as NOOP. Because compression runs per page of results, if an earlier page contains a create event for an item, and a later page contains a subsequent create → delete pair, the NOOP reduction drops the delete from the later page while the earlier create survives - effectively un-deleting the item in the event stream and attaching the full current content. The fix in PR #14289 changes the compression output for create → delete from NOOP to a delete event (retaining the deletion signal), ensuring the earlier orphaned create does not survive across page boundaries. Affected products are identified by CPE cpe:2.3:a:laurent22:joplin:*:*:*:*:*:*:*:*.

RemediationAI

The vendor-released patch is Joplin version 3.5.3, which corrects both the missing share-membership verification in the delta attachment logic and the unsafe create → delete compression in ChangeModel. Administrators running a self-hosted Joplin server should upgrade to 3.5.3 or later; the security advisory is at https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94. As a compensating control prior to patching, administrators can disable server-side note sharing entirely to eliminate the attack surface - this has the side effect of preventing all collaborative sharing for users on that instance. Alternatively, database-level revocation of share records for specific users can limit exposure on a per-user basis, though this requires direct database access and does not address the root compression bug. There is no known configuration-only workaround that neutralizes the delta compression flaw short of applying the 3.5.3 patch.