Privilege Escalation in Joplin Note Taking Application

CVE-2025-27134

What is CVE-2025-27134?

A vulnerability in Joplin's server prior to version 3.3.3 allows low-privileged users to exploit the API endpoint PATCH /api/users/:id. By manipulating this endpoint, they can change the is_admin field to 1, granting themselves administrative privileges without appropriate authorization. This oversight poses a significant risk as it can lead to unauthorized actions within the application, enabling users to gain control over sensitive functionalities typically reserved for administrators. Users are urged to upgrade to version 3.3.3 or later to mitigate this security issue.

References