CVE-2026-55179

Received Received - Intake

Information Disclosure in Joplin Server

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-55179

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin_server	3.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Joplin Server before version 3.7.2 has a vulnerability in the GET /items/:id/content route. This route loads item content using an attacker-supplied internal server ID without verifying if the signed-in user owns or can access that item. Any authenticated user who guesses or obtains another user's item ID can read the corresponding note or item content if it is not protected by end-to-end encryption.

Detection Guidance

To detect this vulnerability, check if your Joplin Server version is below 3.7.2. Inspect server logs for unauthorized access attempts to the GET /items/:id/content endpoint. Monitor for unusual data exfiltration patterns from authenticated users.

Impact Analysis

If you use Joplin Server before version 3.7.2, an attacker with access to your account or who guesses item IDs could read your private notes or items that are not encrypted end-to-end. This could lead to unauthorized access to sensitive information stored in your notes.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance risks and potential legal consequences.

Mitigation Strategies

Immediately upgrade Joplin Server to version 3.7.2 or later. Review and restrict access controls to ensure users can only access their own items. Enable end-to-end encryption if not already active to protect note content.

Hi! I’m here to help you understand CVE-2026-55179. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70