CVE-2026-55179: IDOR exposes other users' note

CISO Take

Joplin Server before 3.7.2 has an insecure direct object reference in its GET /items/:id/content route, which loads item content by an attacker-supplied internal ID without checking ownership. Any authenticated user who obtains or guesses another user's item ID can read that user's notes unless end-to-end encryption protects them. The CVSS is a medium 6.5 with high confidentiality impact only. A public PoC exists and SSVC says TRACK*, but EPSS is 0.26% (84th percentile) and it is not in CISA KEV, so there is no sign of active exploitation. Joplin is a general note-taking tool, not an AI/ML component, so the AI-specific exposure is indirect. It matters if teams keep prompts, API keys, model notes or incident write-ups in a shared Joplin Server. Upgrade to 3.7.2 or later, and enable E2EE for sensitive notebooks.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium. The attack is network-based, low complexity, needs only a low-privilege account, and needs no user interaction. Impact is limited to confidentiality (C:H, I:N, A:N). A public PoC exists, but exploitation likelihood is low (EPSS 0.00261) and there is no KEV listing. Exposure is highest on multi-user or self-registration Joplin Server deployments, where any account holder can attempt ID enumeration. Notes protected by end-to-end encryption stay unreadable.

How does the attack unfold?

Initial Access

The attacker signs in to Joplin Server with any valid low-privilege account.

AML.T0012

ID Discovery

The attacker obtains or enumerates internal item IDs belonging to other users.

Exploitation

The attacker requests GET /items/:id/content and the server returns the content without an ownership check.

AML.T0036

Impact

Unencrypted notes are exfiltrated, exposing secrets, prompts or internal AI documentation.

Initial Access

The attacker signs in to Joplin Server with any valid low-privilege account.

AML.T0012

ID Discovery

The attacker obtains or enumerates internal item IDs belonging to other users.

Exploitation

The attacker requests GET /items/:id/content and the server returns the content without an ownership check.

AML.T0036

Impact

Unencrypted notes are exfiltrated, exposing secrets, prompts or internal AI documentation.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Joplin Server to 3.7.2 or later (fix in upstream commit 63dfa3b and PR #15657). 2) Enable end-to-end encryption for notebooks containing sensitive content, since E2EE items are not readable even if fetched. 3) Restrict or disable open user registration and review the list of accounts on the server. 4) Rotate any secrets (API keys, tokens) stored in unencrypted notes on affected servers. 5) For detection, review reverse-proxy and server logs for authenticated users requesting many /items/:id/content paths, especially sequential or unfamiliar IDs and a high rate of 403/404 responses followed by 200s.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality and confidentiality of data for AI systems

NIST AI RMF

MANAGE 2.3-Risk treatment and response mechanisms

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-55179?

Joplin Server before 3.7.2 has an insecure direct object reference in its GET /items/:id/content route, which loads item content by an attacker-supplied internal ID without checking ownership. Any authenticated user who obtains or guesses another user's item ID can read that user's notes unless end-to-end encryption protects them. The CVSS is a medium 6.5 with high confidentiality impact only. A public PoC exists and SSVC says TRACK*, but EPSS is 0.26% (84th percentile) and it is not in CISA KEV, so there is no sign of active exploitation. Joplin is a general note-taking tool, not an AI/ML component, so the AI-specific exposure is indirect. It matters if teams keep prompts, API keys, model notes or incident write-ups in a shared Joplin Server. Upgrade to 3.7.2 or later, and enable E2EE for sensitive notebooks.

Is CVE-2026-55179 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55179, increasing the risk of exploitation.

How to fix CVE-2026-55179?

1) Upgrade Joplin Server to 3.7.2 or later (fix in upstream commit 63dfa3b and PR #15657). 2) Enable end-to-end encryption for notebooks containing sensitive content, since E2EE items are not readable even if fetched. 3) Restrict or disable open user registration and review the list of accounts on the server. 4) Rotate any secrets (API keys, tokens) stored in unencrypted notes on affected servers. 5) For detection, review reverse-proxy and server logs for authenticated users requesting many /items/:id/content paths, especially sequential or unfamiliar IDs and a high rate of 403/404 responses followed by 200s.

What systems are affected by CVE-2026-55179?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted knowledge management servers, Shared note and documentation platforms used by AI/ML teams.

What is the CVSS score for CVE-2026-55179?

CVE-2026-55179 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

Self-hosted knowledge management serversShared note and documentation platforms used by AI/ML teams

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

Exploitation Scenario

An attacker with a low-privilege account on a shared Joplin Server, for example one given to a contractor or created through open registration, sends authenticated requests to GET /items/:id/content with enumerated or leaked internal item IDs. The server returns content belonging to other users without an ownership check. The attacker harvests unencrypted notes, which may hold LLM provider API keys, prompt templates, model evaluation notes or security findings. They then use the stolen credentials to reach AI services or to plan further attacks.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.