Executive brief
Trilium Notes is a hierarchical note-taking application used to manage personal knowledge bases. A security flaw in the desktop version allows anyone on the same network (such as a corporate LAN or public Wi-Fi) to access and modify a user's private notes without a password. This could lead to the theft of sensitive information or the injection of malicious content into the user's database, potentially leading to further system compromise.
Technical details
An authentication bypass exists in the Clipper API of Trilium Desktop when running in an Electron environment. The vulnerability stems from a design flaw in the routing logic where authentication middleware is explicitly disabled if the application detects it is running under Electron. This exposes sensitive endpoints, such as /api/clipper/notes and /api/clipper/handshake, to the network without requiring an API token, password, or CSRF protection. An unauthenticated attacker on the same network can discover the service via port scanning (typically port 37840) and perform unauthorized actions, including reading data or injecting malicious notes. The issue is resolved in version 0.102.2.
Affected products
- TriliumNext Trilium Notes <= 0.102.1
Timeline
- 2026-05-11: advisory: Original GitHub security advisory published
- 2026-05-20: disclosed: CVE-2026-39310 published to NVD
- 2026-04-05: patched: Version 0.102.2 released with security fixes