CVE-2026-55179

6.5 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows authenticated users to read other users' notes if they obtain or guess another user's item ID, due to lack of proper validation.
Exploitability: Exploitation requires obtaining or guessing another user’s item ID and being authenticated as a user. The difficulty is moderate given the need for authentication but easy if the ID can be guessed.
Blast radius: If exploited, it could lead to data breaches affecting multiple users’ sensitive information within the application.
Prioritized remediation: Update to Joplin version 3.7.2 or later to apply the necessary security fix.

auth-bypassnote-accessweb-app

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-639

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.