Joplin Server EUVD-2026-84176

Requires a Joplin Server deployment (prior to 3.7.2) configured for MIXED authentication - both local password accounts AND SAML SSO enabled (SAML_ENABLED=true). The attacker must control or influence an IdP session capable of asserting an existing local user's email address; with that, a single POST /api/saml returns a valid session for the matched local account with no knowledge of its password. Not exploitable on default single-auth deployments, SAML-only or local-only instances, or where the attacker cannot induce the IdP to assert the victim's email. No Joplin credentials and no user interaction with the victim are required.

This is a genuine authentication-bypass (CWE-290) with a well-corroborated fix, but its real-world priority is bounded by a specific deployment gate. The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is credible: the flaw is reachable over the network with no Joplin credentials (PR:N), but AC:H correctly reflects that it only manifests in Joplin Server instances configured for MIXED local + SAML authentication and requires the attacker to control an IdP session that can assert a victim's email address - a non-trivial precondition. No EPSS score, no CISA KEV entry, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; the absence of KEV/EPSS signals means there is no evidence of widespread or automated exploitation, and the AC:H gating argues for targeted rather than opportunistic abuse. The C:H/I:H/A:N impact is sound - full read/write to a victim's notes, files, and settings, but no availability effect. Net: a real, patch-worthy account-takeover issue for the narrow population running Joplin Server with SAML alongside local accounts; lower operational urgency for the much larger base of Joplin desktop/single-auth users who are not affected. All signals are consistent; the main uncertainty is exploit availability, which is simply unreported rather than conflicting.

An organization runs Joplin Server with both local password accounts and SAML SSO enabled. An attacker who can make their federated IdP session assert a target's email address submits POST /api/saml; because ssoLogin() matches the existing local account by email without checking is_external, the attacker receives an authenticated session for that local account and reads or modifies the victim's notes, files, and settings without ever knowing the password. No public exploit code is identified, but the attack requires no Joplin credentials and only a single crafted SAML login request.