Is CVE-2026-49450 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49450 being exploited in the wild.

How severe is CVE-2026-49450?

High severity, with a CVSS score of 7.1, published 21 September 2026.

Is there a fix for CVE-2026-49450?

A patch was published on 2026-05-27: Fix merged in version 3.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49450 attacked?

It is attacked over the network.

Am I affected by CVE-2026-49450?

Check whether you run Joplin Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49450: Joplin Desktop unsigned update acceptance on Windows

CVE-2026-49450 · Severity: high · CVSS 7.1 · Published 2026-09-21

Joplin Desktop for Windows failed to verify the publisher signature of application updates, allowing an attacker who intercepts the update stream to replace legitimate updates with malicious installers. When users approve the installation, the attacker's code runs with full user privileges, potentially stealing notes, passwords, and other sensitive data stored by the application.

Technologies: Joplin Desktop. Vendors: Joplin.

Quick answers

Is CVE-2026-49450 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49450 being exploited in the wild.
How severe is CVE-2026-49450?: High severity, with a CVSS score of 7.1, published 21 September 2026.
Which products and versions are affected?: Joplin Desktop prior to 3.7.2.
Is there a fix for CVE-2026-49450?: A patch was published on 2026-05-27: Fix merged in version 3.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49450 attacked?: It is attacked over the network.
Am I affected by CVE-2026-49450?: Check whether you run Joplin Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a missing publisherName field in the electron-builder Windows configuration, causing NsisUpdater.verifySignature() to skip Authenticode signature validation against Joplin's expected certificate. An attacker with network access to the update delivery path can substitute unsigned or differently-signed installers. The fix adds the publisherName declaration to enforce signature verification on the client side.

Affected products

Joplin Desktop prior to 3.7.2

Timeline

2026-09-21: disclosed: CVE-2026-49450 published
2026-05-27: patched: Fix merged in version 3.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.