CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes
Attackers can reset user passwords using unrelated tokens, leading to account takeover and session deletion in Joplin Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105785?
CVE-2026-105785 is a medium-severity authentication bypass vulnerability in laurent22 joplin, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
Which versions are affected by CVE-2026-105785?
How do I fix CVE-2026-105785?
No fix has been published for CVE-2026-105785 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105785 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105785 exists.
Sources
Also known as GHSA-8qm8-mp6h-qf35.