Is CVE-2026-34600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34600 being exploited in the wild.

How severe is CVE-2026-34600?

Medium severity, with a CVSS score of 5.7, published 19 May 2026.

Is there a fix for CVE-2026-34600?

A patch was published on 2026-02-09: Initial partial fix merged in PR 14289 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34600 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34600?

Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34600: Joplin Server incorrect authorization in delta API

CVE-2026-34600 · Severity: medium · CVSS 5.7 · Published 2026-05-19

Joplin is an open-source note-taking and to-do application. A logic error in the Joplin Server component allows users who previously had access to a shared notebook to continue downloading notes even after their access has been revoked. This could lead to the unauthorized exposure of sensitive personal or corporate information to individuals who should no longer see it.

Technologies: Joplin Server. Vendors: Joplin.

Quick answers

Is CVE-2026-34600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34600 being exploited in the wild.
How severe is CVE-2026-34600?: Medium severity, with a CVSS score of 5.7, published 19 May 2026.
Which products and versions are affected?: Joplin Server <= 3.5.2.
Is there a fix for CVE-2026-34600?: A patch was published on 2026-02-09: Initial partial fix merged in PR 14289 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34600 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34600?: Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Joplin Server's `ChangeModel.delta` component arises from two primary logic errors. First, when `DELTA_INCLUDES_ITEMS` is enabled, the server attaches the latest state of items to the delta output without verifying if those items remain shared with the requesting user. Second, the change compression logic incorrectly reduces a 'create-delete' sequence to a 'NOOP'. Because this compression is applied per page, a 'delete' event can be dropped if its corresponding 'create' event occurred on a previous page, causing the API to return a 'create' event for a revoked item. An attacker with a previously valid share invitation can exploit this to sync and download the full content of notes they no longer have permission to access. The issue is fixed in version 3.5.3.

Affected products

Joplin Joplin Server <= 3.5.2

Timeline

2026-01-14: other: Issue first identified via sync fuzzer failure
2026-02-09: patched: Initial partial fix merged in PR 14289
2026-05-15: advisory: Project advisory published for GHSA-88x4-77rc-jw94
2026-05-19: disclosed: CVE-2026-34600 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.