CVE-2026-55179

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2

Description An issue exists where the server loads item content from an internal server ID without verifying if the authenticated user has the necessary permissions to access that item. An authenticated user who obtains or guesses another user's item ID can read the content of the corresponding note or item, provided that end-to-end encryption is not enabled. This occurs at the API endpoint "GET /items/:id/content" via the id variable.

Recommendations Update to version 3.7.2.