CVE-2026-105786

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.13

Description An issue exists where the ApplicationModel.ts model accepts a caller-chosen application authorization identifier. The endpoint 'applications/:id/confirm' binds this identifier to a logged-in user via a generic consent page. Subsequently, the public endpoint 'packages/server/src/routes/api/application auth.ts' passes this identifier to the createAppPassword() function without authenticating or binding the redeemer. This allows an attacker to trick a victim into approving a malicious identifier, obtain a durable application ID and password, and exchange these credentials for a session with full read and write access to the victim's synchronized data.

Recommendations Update to version 3.7.13.