# CVE-2026-49450: Joplin Desktop unsigned update acceptance on Windows

Source: https://junglewise.ai/threats/cve-2026-49450-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-49450 · Severity: high · CVSS 7.1 · Published 2026-09-21

Joplin Desktop for Windows failed to verify the publisher signature of application updates, allowing an attacker who intercepts the update stream to replace legitimate updates with malicious installers. When users approve the installation, the attacker's code runs with full user privileges, potentially stealing notes, passwords, and other sensitive data stored by the application.

Technologies: [Joplin Desktop](https://junglewise.ai/threats/technologies/joplin-desktop-1). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-49450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49450 being exploited in the wild.

**How severe is CVE-2026-49450?** High severity, with a CVSS score of 7.1, published 21 September 2026.

**Which products and versions are affected?** Joplin Desktop prior to 3.7.2.

**Is there a fix for CVE-2026-49450?** A patch was published on 2026-05-27: Fix merged in version 3.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49450 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-49450?** Check whether you run Joplin Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from a missing publisherName field in the electron-builder Windows configuration, causing NsisUpdater.verifySignature() to skip Authenticode signature validation against Joplin's expected certificate. An attacker with network access to the update delivery path can substitute unsigned or differently-signed installers. The fix adds the publisherName declaration to enforce signature verification on the client side.

## Affected products

- Joplin Desktop prior to 3.7.2

## Timeline

- 2026-09-21: disclosed: CVE-2026-49450 published
- 2026-05-27: patched: Fix merged in version 3.7.2

## References

- [https://github.com/laurent22/joplin/commit/853659edf575c4f526c2b196e0629462aee9df28](https://github.com/laurent22/joplin/commit/853659edf575c4f526c2b196e0629462aee9df28)
- [https://github.com/laurent22/joplin/pull/15539](https://github.com/laurent22/joplin/pull/15539)

## Related threats

- [Joplin Desktop Web Clipper CORS cross-origin token disclosure](https://junglewise.ai/threats/cve-2026-105783-joplin-is-an-open-source-note-taking-and-to-do-application-that)