CVE-2026-55179
Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
Published 21 Sep 2026 • Updated 21 Sep 2026
Severity: MEDIUM
CVSS Base Score
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.
Affected products (1)
- laurent22 joplin
Problem types
- CWE-639: Authorization Bypass Through User-Controlled Key
Get alerted the moment a CVE like this matches your stack.
Create a free account