CVE-2026-55179: Joplin Server Auth Bypass Vulnerability

CVE-2026-55179 Overview

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions of Joplin Server prior to 3.7.2 contain an Insecure Direct Object Reference (IDOR) [CWE-639] in the GET /items/:id/content route defined in packages/server/src/routes/index/items.ts. The route loads item content directly from an attacker-supplied internal server ID without verifying that the authenticated user owns or has access rights to that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note content when end-to-end encryption is not enabled. The issue is fixed in Joplin Server version 3.7.2.

Critical Impact
Authenticated users can read other users' notes and item content by supplying arbitrary item IDs to the content endpoint, breaking tenant isolation on shared Joplin Server deployments.

Affected Products

Joplin Server versions prior to 3.7.2
packages/server/src/routes/index/items.ts route handler
Deployments where end-to-end encryption is not enabled for stored items

Discovery Timeline

2026-09-21 - CVE-2026-55179 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55179

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference [CWE-639] in the Joplin Server REST API. When a client issues a request to GET /items/:id/content, the handler calls itemModel.loadWithContent(path.id) using the caller-supplied id parameter. The handler does not consult the ownership or sharing tables to confirm that the authenticated user is entitled to read that item.

An authenticated attacker who enumerates or otherwise obtains internal item IDs can retrieve the raw content of notes belonging to any other user on the same server. The attack succeeds against any item that is stored without end-to-end encryption, since server-side content is returned directly to the caller. Confidentiality is fully impacted; integrity and availability are not affected because the route only reads content.

Root Cause

The route handler treats authentication as sufficient authorization. It resolves the item using the raw path parameter without joining against the caller's owned or shared items. Item IDs are internal server identifiers, not user-scoped resource references, so exposing them through a lookup endpoint without an ownership check trivially discloses cross-tenant data.

Attack Vector

Exploitation requires network access to the Joplin Server API and any valid low-privilege account. The attacker sends authenticated GET requests to /items/:id/content with item IDs harvested from prior API responses, shared notebook metadata, or enumeration. No user interaction and no elevated privileges are required.

typescript

// Security patch in packages/server/src/routes/index/items.ts
// Fix: enforce ownership check before loading item content
router.get('items/:id/content', async (path: SubPath, ctx: AppContext) => {
	const itemModel = ctx.joplin.models.item();
	const canAccess = ctx.joplin.owner.is_admin || await itemModel.userHasItem(ctx.joplin.owner.id, path.id);
	if (!canAccess) throw new ErrorNotFound();

	const item = await itemModel.loadWithContent(path.id);
	if (!item) throw new ErrorNotFound();
	return respondWithItemContent(ctx.response, item, item.content);
});

Source: Joplin commit 63dfa3b. The patch adds an explicit userHasItem check (or admin bypass) before the item is loaded, returning ErrorNotFound when the caller lacks access.

Detection Methods for CVE-2026-55179

Indicators of Compromise

Authenticated GET /items/:id/content requests where the requesting user ID does not match the owning user of the returned item in application logs.
Sequential or high-volume access patterns to /items/:id/content from a single account, indicating item ID enumeration.
Successful 200 OK responses on /items/:id/content immediately preceded by requests probing IDs that returned 404 for the same user.

Detection Strategies

Correlate Joplin Server access logs against the items database to flag any content responses served for item IDs not owned or shared with the requesting user.
Alert on any single authenticated session requesting content for more than a threshold of distinct item IDs within a short window.
Review web application firewall or reverse proxy logs for scripted access patterns targeting the /items/ route.

Monitoring Recommendations

Enable verbose request logging on the Joplin Server reverse proxy and forward logs to a centralized analytics or SIEM platform for retention and query.
Track the ratio of /items/:id/content requests to items actually owned by each user account, and alert on statistical outliers.
Monitor account creation and immediate high-volume item access, which may indicate an attacker provisioning a low-privilege account to harvest notes.

How to Mitigate CVE-2026-55179

Immediate Actions Required

Upgrade Joplin Server to version 3.7.2 or later, which enforces the ownership check on the item content route.
Enable end-to-end encryption for all Joplin clients so that even direct server-side reads return only ciphertext to unauthorized parties.
Rotate or invalidate active Joplin Server sessions and audit accounts created recently on multi-tenant deployments.

Patch Information

The fix is delivered in Joplin Server 3.7.2 via Pull Request #15657 and commit 63dfa3b. See the GitHub Security Advisory GHSA-r865-g55x-3mfc for full advisory details. The patch adds an authorization check that calls itemModel.userHasItem(ownerId, itemId) before loading item content and returns ErrorNotFound on failure.

Workarounds

If upgrading immediately is not possible, restrict Joplin Server access to trusted users only using network controls, VPN, or reverse-proxy authentication.
Enforce end-to-end encryption across all Joplin clients so that server-side item content is stored as ciphertext and cannot be read by other authenticated users.
Disable new account registration on public-facing Joplin Server instances to limit the pool of accounts that can invoke the vulnerable route.

bash

# Example: verify installed Joplin Server version and upgrade via Docker
docker inspect joplin-server --format '{{.Config.Image}}'
docker pull joplin/server:3.7.2
docker stop joplin-server && docker rm joplin-server
# Recreate the container using your existing environment file, pinned to 3.7.2
docker run -d --name joplin-server --env-file /etc/joplin/server.env \
  -p 22300:22300 joplin/server:3.7.2