Executive brief
Joplin is an open-source note-taking and to-do application. A logic error in the Joplin Server component allows users who previously had access to a shared notebook to continue downloading notes even after their access has been revoked. This could lead to the unauthorized exposure of sensitive personal or corporate information to individuals who should no longer see it.
Technical details
A vulnerability in Joplin Server's `ChangeModel.delta` component arises from two primary logic errors. First, when `DELTA_INCLUDES_ITEMS` is enabled, the server attaches the latest state of items to the delta output without verifying if those items remain shared with the requesting user. Second, the change compression logic incorrectly reduces a 'create-delete' sequence to a 'NOOP'. Because this compression is applied per page, a 'delete' event can be dropped if its corresponding 'create' event occurred on a previous page, causing the API to return a 'create' event for a revoked item. An attacker with a previously valid share invitation can exploit this to sync and download the full content of notes they no longer have permission to access. The issue is fixed in version 3.5.3.
Affected products
- Joplin Joplin Server <= 3.5.2
Timeline
- 2026-01-14: other: Issue first identified via sync fuzzer failure
- 2026-02-09: patched: Initial partial fix merged in PR 14289
- 2026-05-15: advisory: Project advisory published for GHSA-88x4-77rc-jw94
- 2026-05-19: disclosed: CVE-2026-34600 published