CVE-2026-105783

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.13

Description When the opt-in Web Clipper server is enabled in Joplin Desktop, the server in packages/lib/ClipperServer.ts sends an Access-Control-Allow-Origin: * header. This allows arbitrary websites to call the 'POST /auth' and 'GET /auth/check' API endpoints because the pairing endpoints do not reject HTTP or HTTPS origins. Since the desktop confirmation dialog does not identify the requesting origin, a user who approves the prompt grants the attacking page a permanent API token. This token allows continuous read and write access to notes, folders, tags, resources, and master keys.

Recommendations Update to version 3.7.13.