CVE-2026-49450

Received Received - Intake

Joplin Desktop for Windows Authenticode Signer Verification Bypass

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-49450

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin	3.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-353	The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

Joplin Desktop for Windows before version 3.7.2 has a flaw where the publisherName field is missing from package.json. This causes the app-update.yml file to skip verifying the Authenticode signer of downloaded updates. Attackers can exploit this by replacing update metadata and installers, leading to unsigned or differently signed installers being accepted. This allows arbitrary code execution with user privileges.

Detection Guidance

Check if your Joplin Desktop for Windows version is below 3.7.2. Look for unsigned or mismatched Authenticode signatures in update files. Verify the publisherName field in packages/app-desktop/package.json is present.

Impact Analysis

If you use Joplin Desktop for Windows before 3.7.2, an attacker could trick you into installing malicious software. This could lead to loss of notes, credentials, and local data. The attacker gains the same access as your user account, potentially compromising sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and integrity. Organizations using affected versions may face compliance violations, legal risks, and potential fines.

Mitigation Strategies

Upgrade Joplin Desktop for Windows to version 3.7.2 or later immediately. Ensure all future updates are verified against the correct publisherName. Monitor network traffic for unexpected update requests.

Hi! I’m here to help you understand CVE-2026-49450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70