Is CVE-2026-55210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55210 being exploited in the wild.

How severe is CVE-2026-55210?

High severity, with a CVSS score of 7.4, published 21 September 2026.

Is there a fix for CVE-2026-55210?

A patch was published on 2026-06-11: Fix merged to dev branch in commit b6d69d0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55210 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55210?

Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55210: Joplin Server SAML authentication bypass to local account access

CVE-2026-55210 · Severity: high · CVSS 7.4 · Published 2026-09-21

Joplin Server is a note-taking application that stores and organizes user notes, files, and settings. In deployments using both SAML and local password authentication, an attacker can log in to a victim's local account using SAML if they control a SAML identity provider (IdP) that can assert the victim's email address. This allows unauthorized access to or modification of the victim's notes, files, and account settings without knowing their password.

Technologies: Joplin Server. Vendors: Joplin.

Quick answers

Is CVE-2026-55210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55210 being exploited in the wild.
How severe is CVE-2026-55210?: High severity, with a CVSS score of 7.4, published 21 September 2026.
Which products and versions are affected?: Joplin Server before 3.7.2.
Is there a fix for CVE-2026-55210?: A patch was published on 2026-06-11: Fix merged to dev branch in commit b6d69d0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55210 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55210?: Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Joplin Server's UserModel.ssoLogin() function, which does not validate the is_external flag when matching accounts by IdP-asserted email. An attacker with control of an IdP session can POST to /api/saml with an email matching an existing local password account, receive a valid session, and access the victim's account. The fix restricts SAML login to accounts explicitly created via SSO, rejecting SAML logins for local password accounts.

Affected products

Joplin Server before 3.7.2

Timeline

2026-09-21: disclosed: CVE-2026-55210 published
2026-06-11: patched: Fix merged to dev branch in commit b6d69d0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.