{"id":"CVE-2026-55179","published":"2026-09-21T21:17:05.463","lastModified":"2026-09-21T21:17:05.463","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/laurent22/joplin/commit/63dfa3b5ab47f29129348b4cd3a161a2dce6bc0e","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15657","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc","tags":[]}],"exploitRefs":[{"url":"https://github.com/laurent22/joplin/commit/63dfa3b5ab47f29129348b4cd3a161a2dce6bc0e","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15657","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to read other users' notes if they obtain or guess another user's item ID, due to lack of proper validation.","exploitability":"Exploitation requires obtaining or guessing another user’s item ID and being authenticated as a user. The difficulty is moderate given the need for authentication but easy if the ID can be guessed.","blast_radius":"If exploited, it could lead to data breaches affecting multiple users’ sensitive information within the application.","remediation":"Update to Joplin version 3.7.2 or later to apply the necessary security fix.","tags":["auth-bypass","note-access","web-app"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:20:21.322Z"}}