CVE-2026-59815
Joplin: Pending share recipients can write items into shared folders before accepting invitations
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.
| CWE | CWE-863 |
| Vendor | laurent22 |
| Product | joplin |
| Published | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for laurent22 joplin
Be the first to know when new medium vulnerabilities affecting laurent22 joplin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
laurent22 / joplin
< 3.7.7