CVE-2026-55210
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
Published 21 Sep 2026 • Updated 21 Sep 2026
Severity: HIGH
CVSS Base Score
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.
Affected products (1)
- laurent22 joplin
Problem types
- CWE-290: Authentication Bypass by Spoofing
Get alerted the moment a CVE like this matches your stack.
Create a free account