CVE-2026-59815

Received Received - Intake

Joplin Server Improper Authorization Before Acceptance

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-59815

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin_server	3.7.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Joplin Server before 3.7.7 has a flaw in ItemModel.checkIfAllowed() that allows low-privileged authenticated users to write to shared items without accepting the share invitation. This happens because the system checks for any share_users row instead of requiring ShareUserStatus.Accepted. Attackers can inject content into shared folders before accepting invitations, which then gets propagated to owners and accepted participants.

Detection Guidance

Detecting this vulnerability requires checking if your Joplin Server version is below 3.7.7. Use commands like 'joplin-server --version' or check package managers (e.g., 'apt list --installed | grep joplin-server') to verify the installed version.

Impact Analysis

An attacker could add unauthorized notes or tasks to your shared folders before accepting an invitation. This could lead to data corruption, misinformation, or disruption of your workflow if the injected content is malicious or incorrect.

Compliance Impact

The vulnerability allows unauthorized data modification by low-privileged users, which could lead to unauthorized access or alteration of sensitive information. This may violate GDPR's integrity and confidentiality principles or HIPAA's access controls, depending on the data processed.

Mitigation Strategies

Upgrade Joplin Server to version 3.7.7 or later immediately. Review shared items for unauthorized content before and after upgrading. Restrict write permissions for pending share invitations until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-59815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70