Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-55179Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in joplin from laurent22. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

Affected products (as reported)

Vendor	Product	Versions
laurent22	joplin	< 3.7.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/15657 x_refsource_MISC
https://github.com/laurent22/joplin/commit/63dfa3b5ab47f29129348b4cd3a161a2dce6bc0e x_refsource_MISC