Logic Error in Joplin Note-Taking Application Exposes Shared Notes

CVE-2026-34600

What is CVE-2026-34600?

In the Joplin note-taking application, versions 3.5.2 and earlier are vulnerable due to a logic error in the delta API. This flaw allows users to access notes that should no longer be shared with them. The issue arises because the delta API responds with the latest state of items without checking their sharing status. Consequently, deleted items may still appear as accessible, allowing sensitive information to be disclosed. Furthermore, the change compression logic mismanages the create/delete events, which may result in unauthorized access to previously removed content. The vulnerability has been addressed in version 3.5.3.

References