CVE-2026-105786: Joplin Server: app-auth flaw enables account takeover

HIGHCISA: ATTEND

Published October 5, 2026

CISO Take

Joplin Server before 3.7.13 has a flawed application-authorization flow. An attacker chooses the authorization identifier, tricks a logged-in victim into approving it on a generic consent page, then redeems it at an unauthenticated endpoint for a durable application ID and password. That credential can be exchanged for a full read/write session on the victim's synchronized notes. This is a general note-taking tool, not an AI/ML component, so AI-specific blast radius is limited. It matters mainly where teams store sensitive material in Joplin, such as prompts, API keys, model notes or incident write-ups. Exploitation likelihood is modest: EPSS is 0.00288 (about the 80th percentile), there is no KEV listing, no public exploit and no Nuclei template. It does need victim interaction. Upgrade self-hosted Joplin Server to 3.7.13 or later, review issued application passwords and sessions, and rotate any secrets stored in notes.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High severity per the vendor-assigned rating, but no CVSS vector is available. Exploitation needs a victim to approve an attacker-chosen identifier, and the attacker needs no prior account on the target. The weaknesses are missing authentication (CWE-306), weak randomness or predictability (CWE-330) and incorrect authorization (CWE-863). Exposure is limited to internet-reachable or shared self-hosted Joplin Server instances. Real-world risk is moderate given the low EPSS, no known exploit and no KEV listing, but the impact is full read/write access to the victim's synchronized data with a durable credential.

How does the attack unfold?

Initial Access

The attacker crafts a chosen authorization identifier and lures a logged-in victim to approve it on the consent page.

AML.T0052

Credential Redemption

The attacker redeems the approved identifier at the unauthenticated application_auth endpoint for a durable application ID and password.

AML.T0091

Account Takeover

The attacker exchanges the credential for a victim session with full read/write access to synchronized data.

AML.T0012

Impact

The attacker exfiltrates or alters notes, including stored secrets and AI project material.

AML.T0025

Initial Access

The attacker crafts a chosen authorization identifier and lures a logged-in victim to approve it on the consent page.

AML.T0052

Credential Redemption

The attacker redeems the approved identifier at the unauthenticated application_auth endpoint for a durable application ID and password.

AML.T0091

Account Takeover

The attacker exchanges the credential for a victim session with full read/write access to synchronized data.

AML.T0012

Impact

The attacker exfiltrates or alters notes, including stored secrets and AI project material.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
joplin	—	—	No patch

Do you use joplin? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade Joplin Server to 3.7.13 or later (fix in PR 16270 and commit 1a0a50a). 2) Until patched, restrict server access by VPN or IP allowlist, and tell users not to approve unexpected application-authorization prompts. 3) Review and revoke existing application passwords and sessions, and force re-authentication. 4) Rotate any API keys, tokens or credentials stored in notes. 5) Detection: alert on calls to applications/:id/confirm followed by unauthenticated application_auth requests, new application credentials created without a matching user-initiated client setup, and unusual sync activity from new IPs.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSocial EngineeringData LeakageAPIAML.T0012- Valid Accounts AML.T0091- Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to risks and unknown risks

Frequently Asked Questions

What is CVE-2026-105786?

Is CVE-2026-105786 actively exploited?

No confirmed active exploitation of CVE-2026-105786 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105786?

1) Upgrade Joplin Server to 3.7.13 or later (fix in PR 16270 and commit 1a0a50a). 2) Until patched, restrict server access by VPN or IP allowlist, and tell users not to approve unexpected application-authorization prompts. 3) Review and revoke existing application passwords and sessions, and force re-authentication. 4) Rotate any API keys, tokens or credentials stored in notes. 5) Detection: alert on calls to applications/:id/confirm followed by unauthenticated application_auth requests, new application credentials created without a matching user-initiated client setup, and unusual sync activity from new IPs.

What systems are affected by CVE-2026-105786?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted note and knowledge sync servers, Developer knowledge bases that feed AI workflows.

What is the CVSS score for CVE-2026-105786?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Self-hosted note and knowledge sync serversDeveloper knowledge bases that feed AI workflows

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0091Use Alternate Authentication Material

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

Exploitation Scenario

An attacker generates an application authorization identifier and sends the victim a link to the consent page, for example in a phishing message. A logged-in victim approves it, binding the attacker's identifier to their account. The attacker then calls the public application_auth endpoint, which hands over a durable application ID and password without authenticating or binding the redeemer. The attacker exchanges that credential for a victim session and exports all synchronized notes. Those may include AI project documentation, prompt libraries and pasted API keys, which they use to pivot into LLM provider accounts.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionPrimary CWE-330Use of Insufficiently Random ValuesPrimary CWE-863Incorrect AuthorizationPrimary CWE-306Missing Authentication for Critical Function CWE-330Use of Insufficiently Random Values CWE-863Incorrect Authorization

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.