Is CVE-2026-105785 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105785 being exploited in the wild.

How severe is CVE-2026-105785?

Medium severity, with a CVSS score of 4.8, published 6 October 2026.

Is there a fix for CVE-2026-105785?

Yes: fixed in Joplin Server 3.7.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105785 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105785?

Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105785: Joplin Server token misuse in password reset

CVE-2026-105785 · Severity: medium · CVSS 4.8 · Published 2026-10-06

Joplin Server is an open-source note-taking application that stores and synchronizes notes across devices. A vulnerability allows an attacker who obtains a CSRF or account-confirmation token through other means to reset a victim's password and delete their sessions and API applications, taking over the account. This affects Joplin Server versions before 3.7.2.

Technologies: Joplin Server. Vendors: Joplin.

Quick answers

Is CVE-2026-105785 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105785 being exploited in the wild.
How severe is CVE-2026-105785?: Medium severity, with a CVSS score of 4.8, published 6 October 2026.
Which products and versions are affected?: Joplin Server before 3.7.2.
Is there a fix for CVE-2026-105785?: Yes: fixed in Joplin Server 3.7.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105785 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105785?: Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Joplin Server 3.7.2

Technical details

The vulnerability stems from token-purpose confusion: TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without recording their intended purpose, and UserModel.resetPassword accepts any token returned by TokenModel.userFromToken. An attacker with network access to the public password-reset endpoint can abuse tokens obtained through a separate disclosure to perform unauthorized password resets. The fix scopes tokens by purpose in a database schema migration.

Affected products

Joplin Joplin Server before 3.7.2

Timeline

2026-10-06: disclosed
2026-08-21: patched: Fix commit merged to dev branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.