CVE-2026-59815: Joplin Server: pending share invite allows item injection

MEDIUMCISA: TRACK*

Published September 21, 2026

CISO Take

Joplin Server before 3.7.7 lets a low-privileged user with only a pending, not yet accepted, folder-share invitation write items into the shared folder. Those items then propagate to the owner and accepted participants, so an attacker can inject unwanted note content into other users' notebooks. Exploitation likelihood is low to moderate: EPSS is 0.00232 (87th percentile), there is no public exploit, no Nuclei template, and it is not in CISA KEV, and CISA SSVC rates it TRACK*. The impact is limited to integrity (CVSS 4.3, no confidentiality or availability impact), and Joplin is a note-taking tool that is only indirectly AI-related. It matters most if synced notes feed RAG indexes, LLM assistants or agents, where injected content could become a prompt injection vector. Upgrade Joplin Server to 3.7.7 or later, and review shared folders for items from users with unaccepted invitations.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Low-to-medium risk. Exploitation is network-based, needs low privileges and no user interaction, and the CVSS vector shows integrity-only impact (I:L). The attacker needs an authenticated account on the server and a pending share invitation, which limits exposure to multi-user or shared deployments. EPSS is low in absolute terms (0.00232), no public exploit or scanner template exists, and the CVE is not in KEV. AI-specific risk exists only where synced notes are ingested by AI tooling.

How does the attack unfold?

Initial Access

The attacker authenticates with a low-privilege account that holds a pending folder-share invitation.

AML.T0012

Exploitation

The attacker creates items under the share ID, and checkIfAllowed() accepts the write because a share_users row exists, even though the invitation is not accepted.

Propagation

updateSharedItems3() syncs the injected items to the owner and all accepted participants.

Impact

Unauthorized content appears in victims' notebooks and may feed downstream RAG or AI assistants as poisoned data.

AML.T0070

Initial Access

The attacker authenticates with a low-privilege account that holds a pending folder-share invitation.

AML.T0012

Exploitation

The attacker creates items under the share ID, and checkIfAllowed() accepts the write because a share_users row exists, even though the invitation is not accepted.

Propagation

updateSharedItems3() syncs the injected items to the owner and all accepted participants.

Impact

Unauthorized content appears in victims' notebooks and may feed downstream RAG or AI assistants as poisoned data.

AML.T0070

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

6 steps

Upgrade Joplin Server to 3.7.7 or later (fix commit dff533ccbd2b300eac218a11a7619280865e2e9b).
Until patched, restrict account creation, and avoid sending folder-share invitations to untrusted or unverified users.
Revoke or cancel pending share invitations that are no longer needed.
Audit shared folders for unexpected items, especially ones created by users who never accepted an invitation.
If notes feed RAG or LLM agents, treat note content as untrusted input and add review or sanitization before ingestion.
Monitor server logs for item writes by users whose share status is pending.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPluginAML.T0012- Valid Accounts AML.T0070- RAG Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Risk treatment and response to identified risks

OWASP LLM Top 10

LLM04-Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-59815?

Is CVE-2026-59815 actively exploited?

No confirmed active exploitation of CVE-2026-59815 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59815?

1. Upgrade Joplin Server to 3.7.7 or later (fix commit dff533ccbd2b300eac218a11a7619280865e2e9b). 2. Until patched, restrict account creation, and avoid sending folder-share invitations to untrusted or unverified users. 3. Revoke or cancel pending share invitations that are no longer needed. 4. Audit shared folders for unexpected items, especially ones created by users who never accepted an invitation. 5. If notes feed RAG or LLM agents, treat note content as untrusted input and add review or sanitization before ingestion. 6. Monitor server logs for item writes by users whose share status is pending.

What systems are affected by CVE-2026-59815?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, knowledge base synchronization.

What is the CVSS score for CVE-2026-59815?

CVE-2026-59815 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesagent frameworksknowledge base synchronization

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0070RAG Poisoning

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.

Exploitation Scenario

An attacker with a low-privilege account on a shared Joplin Server gets, or is sent, a pending folder-share invitation to a target's notebook. Without accepting it, the attacker uploads crafted notes under the share ID. The server propagates the notes to the owner and accepted participants. If the victim's team indexes these notebooks in a RAG system or gives an AI assistant access to them, the injected notes may carry indirect prompt injection instructions or false information that influences model outputs.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.