CVE-2026-55210: Joplin Server SAML Authentication Bypass

CVE-2026-55210 Overview

CVE-2026-55210 is an authentication bypass vulnerability in Joplin Server, the backend for the open-source note-taking application Joplin. Versions prior to 3.7.2 fail to check the is_external flag inside UserModel.ssoLogin() when matching users by an Identity Provider (IdP) asserted email address. In deployments running mixed local and Security Assertion Markup Language (SAML) authentication, an attacker who can assert a local user's email through their own IdP session can submit a POST /api/saml request and receive a valid session for that local account. This grants access to the victim's notes, files, and settings without knowledge of the local password. The issue is tracked under [CWE-290: Authentication Bypass by Spoofing].

Critical Impact
Attackers can hijack local Joplin Server accounts through SAML assertions, exposing private notes and enabling data modification without the victim's password.

Affected Products

Joplin Server versions prior to 3.7.2
Deployments using mixed local password and SAML authentication
Self-hosted Joplin Server instances with SSO enabled

Discovery Timeline

2026-09-21 - CVE-2026-55210 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55210

Vulnerability Analysis

The vulnerability resides in the ssoLogin() method of UserModel in the Joplin Server codebase. When a SAML assertion arrives at POST /api/saml, the server calls loadByEmail(email) using the email address asserted by the IdP. If a matching account exists, the server issues a session for that account without verifying whether the account was originally provisioned as an external SSO user.

Accounts created through local password registration and accounts created through SAML share the same email column but differ by the is_external boolean. By failing to check this flag, the login path treats any email match as a valid SSO login. An attacker who controls an IdP session capable of asserting an arbitrary email can therefore log in as any local user.

The attack requires the target instance to accept SAML assertions and share the IdP trust boundary with the attacker, which is why the Common Vulnerability Scoring System (CVSS) vector marks Attack Complexity as High.

Root Cause

The root cause is missing account-type validation during federated login. The account lookup returns the first record matching the asserted email, but the code path does not gate the response on whether that record represents an external identity.

Attack Vector

An attacker with an IdP session that can assert a victim's email address sends a crafted SAML response to POST /api/saml. Joplin Server matches the email to the victim's local account and returns a session cookie bound to that user.

typescript

// Patch: packages/server/src/models/UserModel.ts
let user = await this.loadByEmail(email);

// A local, password-based account already owns this email address. Do
// not allow a SAML assertion to log in as it - this would bypass the
// local account's password.
if (user && !user.is_external) return null;

if (!user) { // User does not exist
    user = {
        email: email,

Source: Joplin commit b6d69d0

Detection Methods for CVE-2026-55210

Indicators of Compromise

Successful POST /api/saml requests followed by session activity on accounts where is_external = false
SAML assertions carrying email addresses that match existing local password accounts
Login events from unexpected IdP source IP ranges targeting administrator or high-value email addresses

Detection Strategies

Correlate Joplin Server access logs against the user database to flag SAML sessions issued for local-only accounts
Alert on any /api/saml response that establishes a session for an account previously authenticated only through /login
Review IdP audit logs for assertions containing email addresses that do not belong to provisioned SSO users

Monitoring Recommendations

Enable verbose authentication logging on the Joplin Server and forward it to a centralized log platform
Monitor for changes to notes, notebooks, and API tokens performed immediately after a SAML login
Track IdP account creation events to identify attacker-controlled accounts that could be used to assert arbitrary emails

How to Mitigate CVE-2026-55210

Immediate Actions Required

Upgrade Joplin Server to version 3.7.2 or later without delay
Audit all existing accounts to identify any local user whose email matches a SAML-provisioned identity
Rotate session tokens and force reauthentication for all users after applying the patch
Review recent /api/saml logins for signs of unauthorized access to local accounts

Patch Information

The fix is available in Joplin Server 3.7.2. The relevant change is committed in Joplin commit b6d69d0 and merged through pull request #15647. Full advisory details are published in GHSA-5px3-4f5x-hjc5. The patch adds an explicit check that returns null from ssoLogin() when the matched account is not marked as external.

Workarounds

Temporarily disable the SAML authentication endpoint until the server can be upgraded to 3.7.2
Restrict IdP trust to a single tenant that provisions all Joplin users, eliminating mixed local and SAML accounts
Migrate local password accounts to SSO-provisioned accounts so that no is_external = false records remain in the database

bash

# Verify installed Joplin Server version and upgrade via Docker
docker inspect joplin-server --format '{{.Config.Image}}'
docker pull joplin/server:3.7.2
docker stop joplin-server && docker rm joplin-server
docker run -d --name joplin-server \
  --env-file /etc/joplin/server.env \
  -p 22300:22300 \
  joplin/server:3.7.2