CVE-2026-105785 in Joplin
Summary
by MITRE • 10/06/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Joplin Server versions prior to 3.7.2 represents a critical authentication bypass flaw rooted in improper token management and validation logic within the server's backend architecture. Specifically, the TokenModel implementation fails to associate cryptographic tokens with their intended operational purpose or context. By storing CSRF protection tokens, account confirmation codes, email change verifiers, and password reset links without distinguishing between these distinct security functions, the system creates a scenario where any valid token generated by the application can be repurposed for unauthorized actions. This architectural oversight violates fundamental principles of secure credential handling, as it removes the necessary contextual binding that prevents tokens from being used outside their specific intended workflow.
The technical mechanism of exploitation relies on the flawed interaction between TokenModel and UserModel. The resetPassword function in UserModel accepts any token returned by userFromToken without verifying whether that token was originally generated for a password reset operation. Consequently, an attacker who gains access to a victim's CSRF token or account confirmation code through separate disclosure channels such as cross-site scripting vulnerabilities, log file exposure, or insecure direct object references can submit this unrelated token to the public password-reset endpoint. The server erroneously validates this mismatched token and proceeds with the authentication flow intended for password recovery rather than its original purpose.
The operational impact of this vulnerability is severe, leading to a complete compromise of user account integrity. Once an attacker successfully submits a misappropriated token through the resetPassword interface, they are able to replace the victim's existing credentials without knowledge of the current password or multi-factor authentication factors. This unauthorized access results in immediate session invalidation for legitimate users and triggers the deletion of associated API applications and active sessions linked to the compromised account. The attacker gains full control over the user profile, potentially leading to data exfiltration, further lateral movement within connected systems, and significant disruption to services relying on Joplin Server infrastructure.
This flaw aligns with CWE-287 Improper Authentication and CWE-613 Insufficient Session Expiration as it involves the misuse of authentication artifacts that lack proper lifecycle management and purpose-specific validation. In terms of MITRE ATT&CK, this vulnerability facilitates Account Manipulation techniques where an adversary alters credentials to maintain persistent access or disrupt availability by invalidating legitimate sessions. The root cause is classified under CWE-209 Generation of Error Message Containing Sensitive Information if the token leakage occurs via error responses, but more broadly it reflects CWE-640 Weak Key Management when considering how tokens are generated and validated without sufficient entropy or binding to specific contexts.
Mitigation strategies require immediate upgrading to Joplin Server version 3.7.2 where these logical flaws have been addressed by implementing strict purpose-based validation for all security tokens. Administrators should also enforce token expiration policies that limit the window of opportunity for exploitation even if a token is leaked. Additionally, integrating robust CSRF protection mechanisms and ensuring that password reset endpoints strictly validate token origins against their intended use cases will prevent similar bypasses in future implementations. Regular security audits focusing on authentication flows and token lifecycle management are recommended to identify and remediate analogous weaknesses across the application stack.