Privilege Escalation in Joplin Note Taking Application

CVE-2025-27134

What is CVE-2025-27134?

A vulnerability in Joplin's server prior to version 3.3.3 allows low-privileged users to exploit the API endpoint PATCH /api/users/:id. By manipulating this endpoint, they can change the is_admin field to 1, granting themselves administrative privileges without appropriate authorization. This oversight poses a significant risk as it can lead to unauthorized actions within the application, enabling users to gain control over sensitive functionalities typically reserved for administrators. Users are urged to upgrade to version 3.3.3 or later to mitigate this security issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References