CVE-2026-105785

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2

Description In the packages/server/src/models/TokenModel.ts file, CSRF, account-confirmation, email-change, and password-reset tokens are stored without a designated purpose. Additionally, the UserModel.resetPassword() function in packages/server/src/models/UserModel.ts accepts any token returned by TokenModel.userFromToken(). An attacker who obtains a victim's CSRF or confirmation token via a separate disclosure channel can submit it to the public password-reset endpoint to change the victim's password, which results in the deletion of existing sessions and API applications.

Recommendations Update Joplin Server to version 3.7.2.