CVE-2026-59815

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7

Description An authorization flaw exists in the ItemModel.checkIfAllowed() function. The system allows write access to items with a share ID if any entry exists for the caller in the share users table, even if the ShareUserStatus.Accepted status is missing. Consequently, a low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID. The ShareModel.updateSharedItems3() function then propagates this injected content to the owner and other accepted participants before the invitation is officially accepted.

Recommendations Update to version 3.7.7.