CVE-2026-55179 Details
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.
A logic error in Joplin Server's item content route prior to version 3.7.2 allows authenticated users to access notes belonging to other users. The vulnerability arises because the route does not validate whether the user has permission to access the requested item, enabling access to any note by supplying the corresponding internal server ID. This issue is particularly concerning when end-to-end encryption is not applied, as it could lead to unauthorized disclosure of unencrypted note content.
Users can update to Joplin Server version 3.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/laurent22/joplin/commit/63dfa3b5ab47f29129348b4cd3a161a2dce6bc0e | [email protected] | Source CodeVendor |
| https://github.com/laurent22/joplin/pull/15657 | [email protected] | Issue TrackingVendor |
| https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Joplin | All versions |
CPE
Remediation
| |
| Joplin Server | <= 3.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |