CVE-2026-105783: Joplin: Web Clipper CORS flaw leaks permanent API token

HIGHPoC AVAILABLE

Published October 5, 2026

CISO Take

Joplin Desktop before 3.7.13 has a flaw in its opt-in Web Clipper server. It answers cross-origin requests from any website, so a malicious page can start the pairing flow and, if the user clicks Approve on a generic prompt that names no origin, receive a permanent API token. That token gives lasting read and write access to notes, folders, tags, resources and master keys, which matters because notes often hold credentials, prompts, API keys and research. Joplin is not an AI/ML framework, so this is only tangentially AI-related: exposure is limited to teams that keep AI project notes or secrets in it. Exploitation needs user interaction and has high complexity. NVD lists no public exploit, no Nuclei template and no KEV listing, and the EPSS score is low at 0.00145, so this is not an emergency. Upgrade Joplin Desktop to 3.7.13 or later, and disable the Web Clipper service where it isn't needed.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Moderate-to-high severity (CVSS 8.0) with low practical exposure. Exploitation requires the Web Clipper server to be enabled (opt-in), a victim visiting an attacker-controlled page, and the victim approving an ambiguous dialog (UI:R, AC:H). EPSS is 0.00145, there is no known public exploit and no KEV entry. The scope change and high confidentiality and integrity impact come from the persistent token, which survives the browsing session. The AI/ML link is indirect: it applies only where Joplin stores AI-related secrets or documentation.

How does the attack unfold?

Initial Access

The victim visits a malicious page that sends cross-origin requests to the local Joplin Web Clipper server.

AML.T0078

Social Engineering

Joplin shows a generic pairing prompt with no origin shown, and the victim approves it.

AML.T0011.003

Credential Theft

The attacking page receives the permanent API token and can use it from then on.

AML.T0091.000

Impact

The attacker reads and modifies notes, resources and master keys, and exfiltrates stored secrets.

AML.T0036

Initial Access

The victim visits a malicious page that sends cross-origin requests to the local Joplin Web Clipper server.

AML.T0078

Social Engineering

Joplin shows a generic pairing prompt with no origin shown, and the victim approves it.

AML.T0011.003

Credential Theft

The attacking page receives the permanent API token and can use it from then on.

AML.T0091.000

Impact

The attacker reads and modifies notes, resources and master keys, and exfiltrates stored secrets.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
joplin	—	—	No patch

Do you use joplin? You're affected.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade Joplin Desktop to 3.7.13 or later (fix in PR #16276, commit 27ae5c0). 2) Disable the Web Clipper service in Joplin settings if you don't use it. 3) Don't approve Web Clipper pairing prompts you didn't start yourself. 4) If you suspect compromise, disable and re-enable the clipper to rotate the token, re-key E2EE if master keys may have been exposed, and rotate any secrets stored in notes. 5) Detection: look for unexpected local connections to the clipper port (default 41184) from browser processes, unexpected pairing dialogs, and unfamiliar note edits. 6) Keep secrets in a dedicated secrets manager, not in note-taking apps.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageSocial EngineeringAPIAML.T0036- Data from Information Repositories AML.T0078- Drive-by Compromise AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 2.3-Responses to unknown or emerging risks

Frequently Asked Questions

What is CVE-2026-105783?

Is CVE-2026-105783 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-105783, increasing the risk of exploitation.

How to fix CVE-2026-105783?

1) Upgrade Joplin Desktop to 3.7.13 or later (fix in PR #16276, commit 27ae5c0). 2) Disable the Web Clipper service in Joplin settings if you don't use it. 3) Don't approve Web Clipper pairing prompts you didn't start yourself. 4) If you suspect compromise, disable and re-enable the clipper to rotate the token, re-key E2EE if master keys may have been exposed, and rotate any secrets stored in notes. 5) Detection: look for unexpected local connections to the clipper port (default 41184) from browser processes, unexpected pairing dialogs, and unfamiliar note edits. 6) Keep secrets in a dedicated secrets manager, not in note-taking apps.

What systems are affected by CVE-2026-105783?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Knowledge management and note-taking tools, Local desktop applications with REST APIs.

What is the CVSS score for CVE-2026-105783?

CVE-2026-105783 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

Developer workstationsKnowledge management and note-taking toolsLocal desktop applications with REST APIs

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0078Drive-by Compromise

AML.T0091.000Application Access Token

Compliance Controls Affected

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13.

Exploitation Scenario

An attacker lures a researcher or engineer to a web page, for example a fake AI paper or tool landing page. Script on the page makes cross-origin calls to POST /auth and GET /auth/check on the local Web Clipper server. The victim sees a generic Joplin authorization prompt that doesn't show the requesting origin and approves it, assuming it is a legitimate clipping request. The page receives the permanent API token and exfiltrates the notebooks, including stored LLM API keys and internal AI project notes. It can then keep reading the notes or modify them for as long as the token remains valid.