# CVE-2026-105786: Joplin Server account takeover via application authorization bypass

Source: https://junglewise.ai/threats/cve-2026-105786-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105786 · Severity: info · Published 2026-10-06

Joplin is an open-source note-taking application that syncs data across devices. A vulnerability in its authorization flow allows an attacker to trick a user into approving an authentication request, then redeem a durable credential to gain full read and write access to the victim's synchronized notes and data without the user's knowledge.

Technologies: [Joplin Server](https://junglewise.ai/threats/technologies/joplin-server). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-105786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105786 being exploited in the wild.

**How severe is CVE-2026-105786?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Joplin Server before 3.7.13.

**Is there a fix for CVE-2026-105786?** Yes: fixed in 3.7.13. Until then: Restrict access to the Joplin Server application authorization endpoints or require additional identity verification before users can approve new applications. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105786 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105786?** Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.7.13

Restrict access to the Joplin Server application authorization endpoints or require additional identity verification before users can approve new applications.

## Technical details

The Joplin Server application authorization endpoint accepts a caller-supplied application ID, displays a generic consent page, and later redeems the authorization without validating the redeemer's identity or enforcing CSRF protection. An attacker can craft a phishing or XSS attack to make a logged-in user approve a malicious application ID, then use the confirmed identifier to obtain an application password that grants full account access. The fix adds session and CSRF validation to the authorization redemption endpoint.

## Affected products

- Joplin Server before 3.7.13

## Timeline

- 2026-10-06: disclosed
- 2026-08-21: patched

## References

- [https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00](https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00)
- [https://github.com/laurent22/joplin/pull/16270](https://github.com/laurent22/joplin/pull/16270)

## Related threats

- [Joplin Server token misuse in password reset](https://junglewise.ai/threats/cve-2026-105785-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server stored XSS in resource sharing via empty title](https://junglewise.ai/threats/cve-2026-59814-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server SAML authentication bypass to local account access](https://junglewise.ai/threats/cve-2026-55210-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server path traversal in transcribe proxy](https://junglewise.ai/threats/cve-2026-59816-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server authentication brute force in SSO endpoint](https://junglewise.ai/threats/cve-2026-46649-joplin-is-an-open-source-note-taking-and-to-do-application-that)