# CVE-2026-34600: Joplin Server incorrect authorization in delta API

Source: https://junglewise.ai/threats/cve-2026-34600-joplin-server-incorrect-authorization-in-delta-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-34600 · Severity: medium · CVSS 5.7 · Published 2026-05-19

Joplin is an open-source note-taking and to-do application. A logic error in the Joplin Server component allows users who previously had access to a shared notebook to continue downloading notes even after their access has been revoked. This could lead to the unauthorized exposure of sensitive personal or corporate information to individuals who should no longer see it.

Technologies: [Joplin Server](https://junglewise.ai/threats/technologies/joplin-server). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-34600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34600 being exploited in the wild.

**How severe is CVE-2026-34600?** Medium severity, with a CVSS score of 5.7, published 19 May 2026.

**Which products and versions are affected?** Joplin Server <= 3.5.2.

**Is there a fix for CVE-2026-34600?** A patch was published on 2026-02-09: Initial partial fix merged in PR 14289 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34600 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34600?** Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Joplin Server's `ChangeModel.delta` component arises from two primary logic errors. First, when `DELTA_INCLUDES_ITEMS` is enabled, the server attaches the latest state of items to the delta output without verifying if those items remain shared with the requesting user. Second, the change compression logic incorrectly reduces a 'create-delete' sequence to a 'NOOP'. Because this compression is applied per page, a 'delete' event can be dropped if its corresponding 'create' event occurred on a previous page, causing the API to return a 'create' event for a revoked item. An attacker with a previously valid share invitation can exploit this to sync and download the full content of notes they no longer have permission to access. The issue is fixed in version 3.5.3.

## Affected products

- Joplin Joplin Server <= 3.5.2

## Timeline

- 2026-01-14: other: Issue first identified via sync fuzzer failure
- 2026-02-09: patched: Initial partial fix merged in PR 14289
- 2026-05-15: advisory: Project advisory published for GHSA-88x4-77rc-jw94
- 2026-05-19: disclosed: CVE-2026-34600 published

## References

- [https://github.com/laurent22/joplin/issues/14110](https://github.com/laurent22/joplin/issues/14110)
- [https://github.com/laurent22/joplin/pull/14289](https://github.com/laurent22/joplin/pull/14289)
- [https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94](https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94)

## Related threats

- [Joplin Server account takeover via application authorization bypass](https://junglewise.ai/threats/cve-2026-105786-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server token misuse in password reset](https://junglewise.ai/threats/cve-2026-105785-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server stored XSS in resource sharing via empty title](https://junglewise.ai/threats/cve-2026-59814-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server SAML authentication bypass to local account access](https://junglewise.ai/threats/cve-2026-55210-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server path traversal in transcribe proxy](https://junglewise.ai/threats/cve-2026-59816-joplin-is-an-open-source-note-taking-and-to-do-application-that)