Log in Start free

Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-105783Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

High 8.0

In plain English

A high-severity cross-site request forgery in joplin from laurent22. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13.

Affected products (as reported)

VendorProductVersions
laurent22 joplin < 3.7.13

Weakness: CWE-346, CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

References