EUVD-2026-84170Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Joplin Server instance
-
DeliveryObtain or guess victim's internal item ID
-
ExploitRequest GET /items/:id/content
-
ExecutionServer skips ownership check
-
ImpactRead victim's note content in cleartext
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account on a Joplin Server instance (the multi-user self-hosted sync backend, not the desktop/mobile app), plus knowledge or a guess of another user's internal server item ID, which are opaque identifiers not exposed in normal UI flows. Exploitation is further limited to items NOT protected by end-to-end encryption: if E2EE is enabled the returned content is ciphertext and confidentiality is preserved. The affected route is GET /items/:id/content prior to version 3.7.2; single-user deployments have no other tenant to target. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) is internally consistent with the description: a network-reachable, low-complexity IDOR on Joplin Server's GET /items/:id/content route that any authenticated (PR:L) user can trigger without user interaction to read another user's note content (C:H, no integrity/availability impact). No EPSS score, KEV listing, or public exploit is present in the input, so this is 'no public exploit identified at time of analysis' - a genuine but not urgently-exploited flaw. Two factors temper real-world risk below the raw score: exploitation requires a valid authenticated account on the target Joplin Server instance, and the description explicitly notes the leak only occurs 'when end-to-end encryption does not protect it' - E2EE-enabled data remains ciphertext and is not disclosed. The practical exploitation gate is the attacker's ability to obtain or guess another user's internal server item ID; these are opaque identifiers, so blind guessing is impractical, but IDs leaked via logs, referrers, or shared infrastructure make it trivial. This is a legitimate multi-tenant access-control bug worth patching, not a high-CVSS/low-real-risk artifact, but its blast radius is confined to self-hosted Joplin Server deployments with multiple users and without E2EE. |
| Exploit ScenarioDerived | An authenticated user on a shared Joplin Server instance obtains or guesses another user's internal item ID and issues GET /items/:id/content; because the route loaded content by internal ID without an ownership check, the server returns the victim's note content in cleartext (when E2EE is not in use). No public exploit code is identified, but the fix PR's test case demonstrates the exact request pattern needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
An insecure direct object reference (CWE-639) in Joplin Server's GET /items/:id/content route lets any authenticated user read notes and items belonging to other users by supplying a guessed or obtained internal item ID, because the handler loads content without verifying ownership. Only Joplin Server deployments (the multi-user self-hosted sync backend, not the desktop or mobile clients) running versions prior to 3.7.2 are affected, and confidentiality is only lost for items not protected by end-to-end encryption - with E2EE enabled the response body is ciphertext. The issue carries a CVSS 3.1 score of 6.5 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix landed in version 3.7.2.
RemediationAI
Upgrade Joplin Server to version 3.7.2 or later, which is the vendor-released patch containing the ownership check in packages/server/src/routes/index/items.ts (see the advisory at https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc, PR https://github.com/laurent22/joplin/pull/15657, and commit https://github.com/laurent22/joplin/commit/63dfa3b5ab47f29129348b4cd3a161a2dce6bc0e). If an immediate upgrade is not possible, the most effective compensating control is to enable end-to-end encryption on notebooks that hold sensitive content: the vulnerable route still returns data, but with E2EE active the returned body is ciphertext and therefore unreadable to the attacker - the trade-off is key management overhead and loss of server-side search/processing for encrypted notebooks. Because the exposure is fundamentally a multi-tenant authorisation gap, restricting Joplin Server access to a single trusted user or to a tightly controlled user set (disabling open registration) reduces the pool of authenticated principals who can attempt the IDOR, at the cost of limiting collaborative use. Network-layer restrictions (VPN-only or IP allow-listing for the server) shrink the attack surface but do not fix the underlying defect and break normal remote sync clients. Since exploitation requires a valid authenticated session, rotating credentials and auditing server logs for anomalous GET /items/:id/content requests against IDs the caller does not own (particularly 404 spikes) is a useful detection measure while patching is scheduled; note that the fix returns 404 rather than 403, so post-patch log noise will look similar to pre-patch failed guesses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Joplin Server is the Node.js/TypeScript synchronisation backend that multi-user Joplin clients sync against, implemented under packages/server. The vulnerable code path lives in packages/server/src/routes/index/items.ts, which registers the Express route GET /items/:id/content. That handler previously resolved the requested item purely from the path parameter and streamed its content back to the caller without any ownership or authorisation check, making it a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) / IDOR defect: the object identifier in the URL is attacker-controllable and is used directly as the lookup key. The upstream fix adds an explicit access decision, evaluating whether the caller is an administrator or whether itemModel.userHasItem(ctx.joplin.owner.id, path.id) returns true, and throws ErrorNotFound() (HTTP 404) when the check fails. A regression test added in packages/server/src/routes/index/items.test.ts creates items owned by session 1 and asserts that session 2 receives a 404 when requesting that item's content, while the legitimate owner receives no error. The 404 (rather than 403) response is a deliberate choice that avoids confirming the existence of other users' item IDs. The underlying platform technologies are Express-style routing over a TypeScript service layer, with item records stored server-side keyed by internal UUIDs; the note payloads themselves are ordinary serialised notes unless client-side end-to-end encryption has been enabled for that notebook.
Know when Joplin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network route reachable by any authenticated user (PR:L, AC:L) with no interaction; discloses another user's note content (C:H) but cannot modify or deny service (I:N/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. Rated
Joplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. Rated medium severity (CVSS 6.1), this vulnerability i
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. Rated
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that parti
Joplin through 1.0.184 allows Arbitrary File Read via XSS. Rated medium severity (CVSS 5.4), this vulnerability is remot
Exploit-DB