CVE-2026-105786: Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

Vulnerability summary

CVE-2026-105786 is a high (CVSS 8.5) vulnerability in laurent22 joplin. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.