{"id":"CVE-2026-105786","published":"2026-10-06T00:16:34.283","lastModified":"2026-10-06T18:16:46.723","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-306","CWE-330","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/16270","tags":[]},{"url":"https://github.com/laurent22/joplin/releases/tag/v3.7.13","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","tags":[]}],"exploitRefs":[{"url":"https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/16270","tags":[]},{"url":"https://github.com/laurent22/joplin/releases/tag/v3.7.13","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","tags":[]}],"hasPoc":true,"ai":null}