Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-105783

CVE-2026-105783: Joplin Desktop Auth Bypass Vulnerability

CVE-2026-105783 is an authentication bypass flaw in Joplin Desktop that allows malicious websites to obtain permanent API tokens through the Web Clipper server. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-105783 Overview

CVE-2026-105783 affects Joplin, an open source note-taking and to-do application. The vulnerability resides in the opt-in Web Clipper server implemented in packages/lib/ClipperServer.ts. Prior to version 3.7.13, the server returns Access-Control-Allow-Origin: * and accepts pairing requests from arbitrary HTTP and HTTPS origins. Any website a victim visits can call POST /auth and GET /auth/check to request a permanent API token. The desktop confirmation dialog does not display the requesting origin, so a user who approves the prompt unknowingly authorizes the attacker. The resulting token grants ongoing read and write access to notes, folders, tags, resources, and master keys.

Critical Impact

An attacker-controlled web page can obtain a permanent Joplin API token, enabling long-term exfiltration and modification of notes, attachments, and encryption keys.

Affected Products

  • Joplin Desktop versions prior to 3.7.13
  • Joplin instances with the opt-in Web Clipper server enabled
  • packages/lib/ClipperServer.ts pairing endpoints

Discovery Timeline

  • 2026-10-06 - CVE CVE-2026-105783 published to NVD
  • 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105783

Vulnerability Analysis

The flaw is an origin validation error classified as [CWE-346]. Joplin Desktop optionally runs a local HTTP server to accept content from the Joplin Web Clipper browser extension. The server was designed to pair only with that extension, but it does not restrict which origins can reach the pairing endpoints. The server also emits a wildcard CORS header, which signals browsers that cross-origin JavaScript may read the responses. A malicious page loaded in the victim's browser can therefore issue the pairing request directly to http://127.0.0.1 on the Clipper port. If the user clicks approve on the generic dialog, the attacking page receives the token in the response body and retains persistent access to the local Joplin data store.

Root Cause

The pairing endpoints POST /auth and GET /auth/check do not filter the Origin header against an allow-list of browser extension origins. The confirmation dialog displayed to the user also lacks the requesting origin, removing the only remaining chance for the user to detect an unauthorized request.

Attack Vector

Exploitation requires user interaction. The victim must have the Web Clipper server enabled and must approve the pairing prompt while visiting an attacker-controlled page. Once approved, the token is harvested over the local loopback interface and used to call the full Joplin data API.

text
// Patched files (from the fix commit)
packages/lib/ClipperServer.test.js
packages/lib/ClipperServer.js

Source: GitHub commit 27ae5c0

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-105783

Indicators of Compromise

  • Unexpected POST /auth or GET /auth/check requests to the Joplin Clipper port (default 41184) originating from browser tabs rather than the Web Clipper extension.
  • Joplin API calls from unknown clients using long-lived tokens after a recent pairing prompt approval.
  • Unexplained modifications to notes, resources, or master keys in the Joplin data directory.

Detection Strategies

  • Inspect host firewall or endpoint telemetry for outbound browser connections to 127.0.0.1:41184 that are not associated with the official Web Clipper extension.
  • Review Joplin logs for /auth pairing requests whose Origin header is an http:// or https:// web page.
  • Hunt for new API tokens issued around the time of suspicious browsing activity.

Monitoring Recommendations

  • Alert on local HTTP services on developer and knowledge-worker endpoints that return Access-Control-Allow-Origin: *.
  • Track installed Joplin versions across the fleet and flag any build below 3.7.13 that has the Clipper server enabled.
  • Correlate browser process network activity with loopback service listeners to detect pairing attempts from arbitrary web origins.

How to Mitigate CVE-2026-105783

Immediate Actions Required

  • Upgrade Joplin Desktop to version 3.7.13 or later on all endpoints.
  • Revoke any existing Web Clipper API tokens through the Joplin options panel and reissue them from the trusted extension only.
  • If upgrade is not immediate, disable the Web Clipper server under Tools > Options > Web Clipper.

Patch Information

The issue is fixed in Joplin 3.7.13. The patch restricts Web Clipper pairing to browser extension origins and adds regression coverage in packages/lib/ClipperServer.test.js. See the GitHub Security Advisory GHSA-9728-v7ww-mxjv, Pull Request #16276, and the v3.7.13 release notes.

Workarounds

  • Disable the Web Clipper server until the Joplin Desktop client is updated.
  • Bind the Clipper port only to the loopback interface and block it with a host firewall rule when not actively clipping.
  • Instruct users to deny any Web Clipper pairing dialog that appears while browsing untrusted sites.
bash
# Verify installed Joplin version meets or exceeds the fixed release
joplin --version
# Expected: 3.7.13 or later

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne