Authentication Bypass in Trilium Desktop by Trilium Notes

CVE-2026-39310

What is CVE-2026-39310?

Trilium Notes, a hierarchical note-taking application, has a significant vulnerability in its Clipper API that affects versions 0.102.1 and earlier. In instances where Trilium runs within an Electron environment, the application disables crucial authentication middleware, inadvertently exposing sensitive API endpoints, such as /api/clipper/notes, without necessary protections. This flaw allows attackers on shared networks to easily scout for open ports typically used by Trilium, enabling them to confirm active instances and conduct unauthorized data access and potential phishing attacks. The issue has been addressed in version 0.102.2, which reinforces security measures to mitigate these risks.

References