CVE-2026-105785

MEDIUM 4.8

Joplin Server password reset accepts tokens issued for unrelated purposes

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.

CWE	CWE-620 CWE-640
Vendor	laurent22
Product	joplin
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for laurent22 joplin

Be the first to know when new medium vulnerabilities affecting laurent22 joplin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

laurent22 / joplin

< 3.7.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35 github.com: https://github.com/laurent22/joplin/pull/16274 github.com: https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118