Is CVE-2026-105786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105786 being exploited in the wild.

How severe is CVE-2026-105786?

Informational severity, published 6 October 2026.

How is CVE-2026-105786 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105786?

Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105786: Joplin Server account takeover via application authorization bypass

CVE-2026-105786 · Severity: info · Published 2026-10-06

Joplin is an open-source note-taking application that syncs data across devices. A vulnerability in its authorization flow allows an attacker to trick a user into approving an authentication request, then redeem a durable credential to gain full read and write access to the victim's synchronized notes and data without the user's knowledge.

Technologies: Joplin Server. Vendors: Joplin.

Quick answers

Is CVE-2026-105786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105786 being exploited in the wild.
How severe is CVE-2026-105786?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Joplin Server before 3.7.13.
Is there a fix for CVE-2026-105786?: Yes: fixed in 3.7.13. Until then: Restrict access to the Joplin Server application authorization endpoints or require additional identity verification before users can approve new applications. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105786 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105786?: Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.7.13

Restrict access to the Joplin Server application authorization endpoints or require additional identity verification before users can approve new applications.

Technical details

The Joplin Server application authorization endpoint accepts a caller-supplied application ID, displays a generic consent page, and later redeems the authorization without validating the redeemer's identity or enforcing CSRF protection. An attacker can craft a phishing or XSS attack to make a logged-in user approve a malicious application ID, then use the confirmed identifier to obtain an application password that grants full account access. The fix adds session and CSRF validation to the authorization redemption endpoint.

Affected products

Joplin Server before 3.7.13

Timeline

2026-10-06: disclosed
2026-08-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.