CVE-2026-59815 Details
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.
A vulnerability in Joplin Server prior to version 3.7.7 allows low-privileged authenticated users with pending folder-share invitations to inject items into shared folders before accepting the invitations. The issue arises because the authorization process for writing items to shared folders does not require confirmation of accepted share status. As a result, a pending recipient can create an item under the share ID, and the injected content is propagated to the share owner and accepted participants before the invitation is accepted.
Users should update to Joplin Server version 3.7.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/laurent22/joplin/security/advisories/GHSA-qq59-gg3w-pf7v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/laurent22/joplin/commit/dff533ccbd2b300eac218a11a7619280865e2e9b | [email protected] | Source CodeVendor |
| https://github.com/laurent22/joplin/security/advisories/GHSA-qq59-gg3w-pf7v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Joplin | All versions |
CPE
Remediation
| |
| Joplin Server | <= 3.6.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |