CVE-2026-59815: Joplin Server Auth Bypass Vulnerability

CVE-2026-59815 Overview

CVE-2026-59815 is a broken authorization vulnerability [CWE-863] in Joplin Server, the backend for the open source Joplin note-taking and to-do application. Versions prior to 3.7.7 permit a low-privileged authenticated user with a pending folder-share invitation to write items into a shared folder before accepting the invitation. The server's ItemModel.checkIfAllowed() grants write access whenever any share_users row exists for the caller, without verifying ShareUserStatus.Accepted. Injected content then propagates to the folder owner and accepted participants through ShareModel.updateSharedItems3(). The vulnerability is fixed in Joplin Server 3.7.7.

Critical Impact

Authenticated users with pending share invitations can inject notes or resources into shared folders, and the content is silently distributed to the owner and every accepted participant.

Affected Products

• Joplin Server versions prior to 3.7.7
• Deployments exposing Joplin Server to multiple registered users
• Self-hosted Joplin sync backends using the affected ItemModel authorization logic

Discovery Timeline

• 2026-09-21 - CVE-2026-59815 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-59815

Vulnerability Analysis

Joplin Server implements folder sharing by associating items with a share_id and tracking recipients in a share_users table. Each recipient row carries a ShareUserStatus field indicating whether the invitation is pending, accepted, or rejected. The authorization check in ItemModel.checkIfAllowed() was designed to gate write access on membership in a share, but it only verified the existence of a share_users row for the caller. It did not require the row to be in the Accepted state.

As a result, a user who has only been invited to a folder can already act as a participant for the purpose of writing items. When such a user creates an item tagged with the shared share_id, the server accepts the write. ShareModel.updateSharedItems3() then treats the item as legitimate shared content and propagates it to the folder owner and every accepted participant.

Root Cause

The root cause is missing state validation in the authorization predicate. The check confirmed the caller was known to the share but not that the caller had accepted the invitation. This turns a UI-level workflow assumption, that content only flows in after acceptance, into an exploitable trust gap at the model layer.

Attack Vector

Exploitation requires an authenticated Joplin Server account and a pending folder-share invitation from a target user. The attacker issues a normal item-write API call, supplying the share_id of the pending share. The server authorizes the write, and Joplin's synchronization pipeline pushes the injected item to the owner and to all accepted participants without further consent. No user interaction is required from the victims.

// Patch: packages/server/src/models/ItemModel.ts
 import BaseModel, { SaveOptions, LoadOptions, DeleteOptions as BaseDeleteOptions, ValidateOptions, AclAction } from './BaseModel';
-import { ItemType, databaseSchema, Uuid, Item, ShareType, Share, ChangeType, User, UserItem } from '../services/database/types';
+import { ItemType, databaseSchema, Uuid, Item, ShareType, ShareUserStatus, Share, ChangeType, User, UserItem } from '../services/database/types';
 import { defaultPagination, paginateDbQuery, PaginatedResults, Pagination } from './utils/pagination';
 import { isJoplinItemName, isJoplinResourceBlobPath, linkedResourceIds, serializeJoplinItem, unserializeJoplinItem } from '../utils/joplinUtils';
 import { ModelType } from '@joplin/lib/BaseModel';
// Source: https://github.com/laurent22/joplin/commit/dff533ccbd2b300eac218a11a7619280865e2e9b

The patch imports ShareUserStatus so the authorization logic can require an Accepted status before permitting writes into a shared folder. Full details are in the GitHub Security Advisory GHSA-qq59-gg3w-pf7v.

Detection Methods for CVE-2026-59815

Indicators of Compromise

• Item write events in Joplin Server logs where the acting user has a share_users row with a non-accepted status for the referenced share_id.
• New notes, folders, or resources appearing in shared notebooks that owners and participants did not create.
• Sync deltas propagating items from accounts that never accepted the corresponding share invitation.

Detection Strategies

• Correlate item creation timestamps with share_users acceptance timestamps to identify writes that predate invitation acceptance.
• Query the Joplin Server database for items whose owner_id differs from the share owner and whose author has a pending invitation.
• Audit API access logs for POST or PUT requests to item endpoints carrying a share_id from callers not yet marked ShareUserStatus.Accepted.

Monitoring Recommendations

• Enable verbose access logging on the Joplin Server item and share endpoints and forward logs to a centralized store.
• Alert on anomalous item creation volume tied to a single non-accepted share recipient.
• Track upgrade status of all Joplin Server instances against version 3.7.7 across the environment.

How to Mitigate CVE-2026-59815

Immediate Actions Required

• Upgrade Joplin Server to version 3.7.7 or later, which enforces ShareUserStatus.Accepted in ItemModel.checkIfAllowed().
• Review outstanding folder-share invitations and revoke any that were sent to untrusted or unknown accounts.
• Inspect shared notebooks for unexpected items authored by users who had not accepted their invitation prior to the item's creation date.

Patch Information

The fix is delivered in Joplin Server 3.7.7 through commit dff533c. The change imports ShareUserStatus into ItemModel and updates the authorization predicate to require an accepted share membership before permitting writes to items associated with a share_id. Administrators of self-hosted deployments should apply the upgrade and restart the server. See the GitHub Security Advisory GHSA-qq59-gg3w-pf7v for the vendor's disclosure.

Workarounds

• Restrict Joplin Server registration to trusted users until the upgrade to 3.7.7 is completed.
• Avoid issuing folder-share invitations to accounts that have not been vetted, since pending invitees can write into the shared folder.
• Manually purge or reject pending share invitations issued to untrusted accounts and monitor shared folders for injected items.

# Upgrade example for Docker-based Joplin Server deployments
docker pull joplin/server:3.7.7
docker stop joplin-server && docker rm joplin-server
docker run -d --name joplin-server \
  --env-file /etc/joplin/joplin.env \
  -p 22300:22300 \
  joplin/server:3.7.7