CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
An attacker can hijack a victim's Joplin account by tricking them into approving a malicious application authorization identifier, gaining full data access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-105786?
CVE-2026-105786 is a high-severity authentication bypass vulnerability in laurent22 joplin, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.
Which versions are affected by CVE-2026-105786?
How do I fix CVE-2026-105786?
No fix has been published for CVE-2026-105786 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105786 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105786 exists.
Sources
Also known as GHSA-435m-gr6q-2fg6.