CVE-2026-55210

Received Received - Intake

Authentication Bypass in Joplin Server via SAML

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-55210

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin_server	3.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

Joplin Server before version 3.7.2 has a flaw in its UserModel.ssoLogin() function. When a user logs in via SAML authentication, the system matches accounts by email without verifying if the account is marked as external. This allows an attacker with access to a victim's email through their Identity Provider (IdP) to gain unauthorized access to the victim's local Joplin account without needing the local password.

Detection Guidance

Detecting this vulnerability requires checking if your Joplin Server version is below 3.7.2. Use the command: curl -s http://your-joplin-server/api/version | grep version. If the version is less than 3.7.2, the system is vulnerable.

Impact Analysis

If you use Joplin Server with mixed local and SAML authentication, an attacker could exploit this to access your notes, files, and settings. They would only need to control your email through the IdP, not your local Joplin password. This could lead to data theft, unauthorized modifications, or loss of confidentiality.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization, leading to potential fines for insufficient data protection. For HIPAA, unauthorized access to health-related notes or files could breach confidentiality requirements, risking penalties for non-compliance.

Mitigation Strategies

Upgrade Joplin Server to version 3.7.2 or later immediately. Review user accounts for unauthorized access, especially those using local authentication in mixed SAML deployments. Disable or audit external IdP sessions that could assert local user emails.

Hi! I’m here to help you understand CVE-2026-55210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70