Cross-Site Request Forgery Vulnerability in Joplin by Laurent22

CVE-2026-105785

What is CVE-2026-105785?

Joplin is an open-source note-taking and to-do application that has a vulnerability where CSRF, account-confirmation, email-change, and password-reset tokens are not securely managed. This flaw in Joplin Server prior to version 3.7.2 allows an attacker to exploit exposed tokens to force a password reset for a victim. By submitting a valid token to the public password-reset endpoint, the attacker can replace the victim's password, leading to compromised accounts and loss of access to existing sessions and API applications. The issue was addressed in Joplin Server 3.7.2, highlighting the importance of secure token handling.

References