CVE-2026-55210: SAML login bypass takes over local

CISO Take

Joplin Server before 3.7.2 lets a SAML login match an existing local account by email without checking whether the account is externally managed, so anyone whose identity provider can assert a victim's email receives a session for that local account, no password needed. The CVSS is 7.4 (high) because exploitation requires control over, or a weak trust boundary with, an IdP, but it gives full read and write access to the victim's notes, files and settings. Exploitation likelihood is low to moderate: EPSS is 0.48% (top 61%), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. Joplin is a note-taking tool with only a loose AI connection, and the blast radius is limited to deployments that mix local and SAML authentication. If you run Joplin Server, upgrade to 3.7.2 or later, and until then disable SAML or stop mixing it with local accounts, and review SAML logins for local users' emails.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Moderate overall risk. Impact is high for confidentiality and integrity (C:H/I:H) because the attacker gets full account access. Exploitation is hard (AC:H) because the attacker needs an IdP session that can assert a victim's email, which means a compromised, misconfigured or multi-tenant IdP, or one that does not verify email ownership. EPSS is low (0.48%), there is no known exploitation or public PoC, and no dependents or package risk data are available. Exposure is limited to Joplin Server instances that enable SAML alongside local accounts. The AI/ML relevance is peripheral: notes may hold prompts, API keys, research or other sensitive material.

How does the attack unfold?

Initial Access

The attacker authenticates at an IdP with a session able to assert the victim's local email address.

AML.T0012

Exploitation

The attacker posts the SAML assertion to POST /api/saml and ssoLogin() returns the existing local account without checking is_external.

AML.T0049

Collection

With a valid session for the victim's account, the attacker reads notes, files and settings, including any stored secrets.

AML.T0036

Impact

The attacker modifies or deletes notes and settings, compromising confidentiality and integrity of the victim's data.

Initial Access

The attacker authenticates at an IdP with a session able to assert the victim's local email address.

AML.T0012

Exploitation

The attacker posts the SAML assertion to POST /api/saml and ssoLogin() returns the existing local account without checking is_external.

AML.T0049

Collection

With a valid session for the victim's account, the attacker reads notes, files and settings, including any stored secrets.

AML.T0036

Impact

The attacker modifies or deletes notes and settings, compromising confidentiality and integrity of the victim's data.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade Joplin Server to 3.7.2 or later (see commit b6d69d07 and PR 15647). 2) If you cannot patch right away, disable SAML login or remove the mix of local and SAML accounts, so that no local account shares an email with an identity the IdP can assert. 3) Harden the IdP: require verified email ownership, restrict who can set or change email attributes, and prevent self-service email changes. 4) Review POST /api/saml logs and session creation for SAML logins that landed on accounts not flagged as external. 5) Rotate any credentials or API keys stored in notes for accounts that may have been affected, and force a password reset and session revocation for them.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responding to unknown or emergent risks

Frequently Asked Questions

What is CVE-2026-55210?

Joplin Server before 3.7.2 lets a SAML login match an existing local account by email without checking whether the account is externally managed, so anyone whose identity provider can assert a victim's email receives a session for that local account, no password needed. The CVSS is 7.4 (high) because exploitation requires control over, or a weak trust boundary with, an IdP, but it gives full read and write access to the victim's notes, files and settings. Exploitation likelihood is low to moderate: EPSS is 0.48% (top 61%), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. Joplin is a note-taking tool with only a loose AI connection, and the blast radius is limited to deployments that mix local and SAML authentication. If you run Joplin Server, upgrade to 3.7.2 or later, and until then disable SAML or stop mixing it with local accounts, and review SAML logins for local users' emails.

Is CVE-2026-55210 actively exploited?

No confirmed active exploitation of CVE-2026-55210 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55210?

1) Upgrade Joplin Server to 3.7.2 or later (see commit b6d69d07 and PR 15647). 2) If you cannot patch right away, disable SAML login or remove the mix of local and SAML accounts, so that no local account shares an email with an identity the IdP can assert. 3) Harden the IdP: require verified email ownership, restrict who can set or change email attributes, and prevent self-service email changes. 4) Review POST /api/saml logs and session creation for SAML logins that landed on accounts not flagged as external. 5) Rotate any credentials or API keys stored in notes for accounts that may have been affected, and force a password reset and session revocation for them.

What systems are affected by CVE-2026-55210?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted note-taking and knowledge-base servers, SAML/SSO-federated applications, Developer and AI research knowledge repositories.

What is the CVSS score for CVE-2026-55210?

CVE-2026-55210 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

Self-hosted note-taking and knowledge-base serversSAML/SSO-federated applicationsDeveloper and AI research knowledge repositories

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.

Exploitation Scenario

An attacker with an account at a federated or poorly governed IdP sets its email to that of a Joplin Server admin or researcher with a local account, for example the lead of an AI security team. The attacker completes SAML authentication and posts the assertion to POST /api/saml. UserModel.ssoLogin() matches the existing local account by email, skips the is_external check and issues a session. The attacker then reads the notes, which may hold model API keys, incident write-ups and architecture notes, and can edit or delete content or change settings.

Weaknesses (CWE)

CWE-290Authentication Bypass by SpoofingPrimary CWE-290Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.