CVE-2026-55210 Details
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.
A vulnerability in Joplin Server prior to version 3.7.2 allows for authentication bypass via SAML Single Sign-On (SSO) assertions. The issue arises in the UserModel.ssoLogin() function, which fails to verify whether an account is managed locally or externally before logging in a user. In environments that use both local and SAML authentication, an attacker can exploit this by having their Identity Provider (IdP) assert an email address belonging to a local user. This allows them to gain access to the victim's account, including notes, files, and settings, without knowing the password. The vulnerability affects Joplin Server versions through 3.7.1.
Users can update to Joplin Server version 3.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/laurent22/joplin/commit/b6d69d072919cbe769234f93d95ed21e1ec129b2 | [email protected] | Source CodeVendor |
| https://github.com/laurent22/joplin/pull/15647 | [email protected] | Issue TrackingVendor |
| https://github.com/laurent22/joplin/security/advisories/GHSA-5px3-4f5x-hjc5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Joplin | All versions |
CPE
Remediation
| |
| Joplin Server | <= 3.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |