CVE-2026-105786: Joplin Authorization Bypass Vulnerability

CVE-2026-105786 Overview

Joplin is an open source note-taking and to-do application that organizes notes and lists into notebooks. Versions prior to 3.7.13 contain a missing authentication flaw in the server's application authorization flow. The packages/server/src/models/ApplicationModel.ts file accepts a caller-chosen application authorization identifier, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can trick a victim into approving the attacker's identifier, redeem a durable application ID and password, and obtain a victim session with full read and write access to synchronized data. The issue is fixed in Joplin 3.7.13.

Critical Impact

Successful exploitation yields full read and write access to the victim's synchronized Joplin notes, notebooks, and attachments through a durable application credential.

Affected Products

• Joplin Server versions prior to 3.7.13
• Joplin clients that synchronize against affected Joplin Server instances
• Self-hosted Joplin deployments exposing applications/:id/confirm and application_auth endpoints

Discovery Timeline

• 2026-10-06 - CVE-2026-105786 published to NVD
• 2026-10-06 - Last updated in NVD database
• Joplin 3.7.13 - Vendor releases patched version with session and CSRF enforcement

Technical Details for CVE-2026-105786

Vulnerability Analysis

The flaw is a missing authentication issue [CWE-306] in Joplin Server's application authorization endpoints. The server allows a caller to choose the application authorization identifier used during the OAuth-like consent flow. The consent page at applications/:id/confirm binds that attacker-chosen identifier to whichever user is currently logged in. The public application_auth endpoint then redeems the identifier for a long-lived application password without verifying that the redeemer is the same party that initiated the request.

The attacker initiates an authorization request, delivers the resulting link to a victim, and waits for the victim to approve. Once approval occurs, the attacker redeems the pre-chosen identifier for a persistent credential that unlocks the victim's synchronized note database.

Root Cause

The authorization endpoint lacks session binding and CSRF protection on the POST that finalizes the consent. Because the identifier is caller-supplied and the redemption endpoint is publicly reachable, the server cannot distinguish between the party that initiated authorization and the party that redeems the credential. User interaction is required, but the victim only sees a generic consent prompt and no indication that the identifier is attacker-controlled.

Attack Vector

Exploitation is network-based and requires a victim to be enticed into visiting the consent URL and clicking approve. The attack can be delivered through phishing, embedded links, or a malicious page that triggers the consent flow for a logged-in Joplin user. After approval, the attacker performs an unauthenticated redemption against application_auth and immediately gains session-level access to synchronized data.

// Patch excerpt - packages/server/src/routes/index/applications.ts
import { SubPath, redirect } from '../../utils/routeUtils';
import Router from '../../utils/Router';
-import { RouteType } from '../../utils/types';
+import { HttpMethod, RouteType } from '../../utils/types';
import { AppContext } from '../../utils/types';
import defaultView from '../../utils/defaultView';
import { formParse, userIp } from '../../utils/requestUtils';

// Patch excerpt - packages/server/src/utils/Router.ts
public public = false;
public publicSchemas: string[] = [];
+
+// Schemas that are public for the listed methods only, and private for all
+// others (e.g. a GET consent page that's reachable before login, while its
+// POST still goes through the session and CSRF checks).
+public publicSchemasByMethod: Partial<Record<HttpMethod, string[]>> = {};

Source: Joplin commit 1a0a50afc9. The fix enforces session and CSRF checks on the application authorization POST while keeping the GET consent page reachable before login.

Detection Methods for CVE-2026-105786

Indicators of Compromise

• Requests to applications/:id/confirm followed by unauthenticated calls to application_auth from a different source IP or user agent.
• Creation of application passwords through ApplicationModel.createAppPassword without a preceding authenticated session for the owning user.
• Successful synchronization sessions originating from newly issued application credentials shortly after a consent event.

Detection Strategies

• Correlate Joplin Server access logs to flag consent approvals where the GET and POST stages, or the subsequent redemption, originate from mismatched client fingerprints.
• Alert on bursts of application_auth redemptions from external IP addresses, especially those targeting multiple accounts.
• Review audit logs for application credentials issued to accounts that normally do not use third-party Joplin integrations.

Monitoring Recommendations

• Ingest Joplin Server web logs into a centralized logging platform and build detections around the application authorization endpoints.
• Track creation and use of long-lived application passwords, and alert on any issued before the upgrade to 3.7.13.
• Monitor outbound synchronization traffic for unfamiliar clients pulling the full note database after a credential-issuance event.

How to Mitigate CVE-2026-105786

Immediate Actions Required

• Upgrade Joplin Server to version 3.7.13 or later on all self-hosted and managed instances.
• Revoke every application password issued before the upgrade and require users to re-authorize legitimate integrations.
• Force session invalidation for all users and review recent sync activity for anomalous clients.

Patch Information

The fix is included in Joplin release v3.7.13 and merged via pull request #16270. The upstream commit 1a0a50afc9 enforces session and CSRF checks on the application authorization POST. Additional detail is published in GitHub Security Advisory GHSA-435m-gr6q-2fg6.

Workarounds

• If an immediate upgrade is not possible, block external access to applications/:id/confirm and application_auth endpoints at the reverse proxy until patching is complete.
• Disable third-party application authorization in the Joplin Server configuration where that option is available.
• Restrict Joplin Server to trusted networks or require VPN access to reduce exposure to phishing-delivered consent links.

# Example nginx snippet to block application auth endpoints until patched
location ~ ^/(applications/.+/confirm|api/application_auth) {
    deny all;
    return 403;
}