CVE-2026-55210

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2

Description In deployments using mixed local and SAML authentication, the UserModel.ssoLogin() function returns an existing account matched by an Identity Provider (IdP)-asserted email without verifying the account's is external flag. An attacker capable of asserting a local user's email via an IdP session can send a request to the 'POST /api/saml' endpoint to obtain a session for that local account. This allows unauthorized access to and modification of the victim's notes, files, and settings without requiring the local password.

Recommendations Update to version 3.7.2.