CVE-2026-59815 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin Server prior to version 3.7.7 represents a critical authorization flaw within the application's sharing mechanism, specifically affecting how write permissions are validated for shared items. The core technical deficiency lies in the ItemModel.checkIfAllowed() function, which governs access control decisions when users attempt to create or modify content associated with a specific share ID. In vulnerable versions of the software, this validation logic incorrectly determines that any authenticated user who has an existing entry in the share_users table for a given resource is authorized to write to it. This check fails to verify the actual status of the sharing relationship, specifically ignoring whether the ShareUserStatus field indicates that the invitation has been accepted by the recipient. Consequently, the system treats pending invitations as equivalent to active, confirmed shares, thereby granting unauthorized write access to individuals who have not yet consented to participate in the shared workspace.
This architectural oversight allows a low-privileged authenticated user with a pending folder-share invitation to inject malicious or disruptive content into a notebook they do not officially own or control. Because the authorization check does not enforce acceptance of the invite, an attacker can exploit this window between receiving and accepting the invitation to create items under the share ID. The operational impact is exacerbated by the behavior of ShareModel.updateSharedItems3(), which propagates these newly created items to the notebook owner and all participants who have already accepted their invitations. This means that malicious content injected during this pending state can be distributed widely across the shared environment before the attacker even formally joins the group, potentially causing data corruption, phishing attacks via embedded links in notes, or denial of service through spamming legitimate users with unwanted information.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges that they should not possess due to flawed access control logic. Furthermore, the exploitation technique falls under MITRE ATT&CK T1078, specifically Valid Accounts and potentially Initial Access if used for further infiltration, though in this context it is more accurately described as a lateral movement or privilege escalation within the application's sharing scope where an unaccepted role is treated as accepted. The flaw highlights a common pitfall in web applications where state transitions are not strictly enforced during permission checks, leading to race conditions or logic bypasses that compromise data integrity and confidentiality.
To mitigate this vulnerability, organizations running Joplin Server must upgrade immediately to version 3.7.7 or later, which contains the necessary code corrections to enforce proper status validation in the ItemModel.checkIfAllowed() function. Until an upgrade is feasible, administrators should monitor for unusual activity patterns involving pending share invitations and consider restricting write permissions on shared notebooks until all participants have formally accepted their invites. Additionally, implementing strict input validation and ensuring that authorization checks always verify both identity and current state against a trusted source of truth can prevent similar logic flaws in other parts of the application or future updates. Regular security audits focusing on access control lists and permission inheritance models are recommended to identify and remediate any analogous weaknesses across the platform's sharing infrastructure.