Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-49450Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

High 7.1

In plain English

A high-severity insufficient verification of data authenticity in joplin from laurent22. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 92.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

Affected products (as reported)

Vendor	Product	Versions
laurent22	joplin	< 3.7.2

Weakness: CWE-345, CWE-353, CWE-494 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273 x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/15539 x_refsource_MISC
https://github.com/laurent22/joplin/commit/853659edf575c4f526c2b196e0629462aee9df28 x_refsource_MISC