Improper Access Control in Joplin Server Affects User Data Security

CVE-2026-55179

What is CVE-2026-55179?

Joplin Server, an open-source note-taking and to-do application, has a vulnerability that allows authenticated users to access and read items that they do not own. This occurs because the server's GET /items/:id/content route fails to verify ownership when fetching item content based on an attacker-supplied internal server ID. If end-to-end encryption is not in use, any user with knowledge of another's item ID can retrieve the associated notes or content, potentially leading to data breaches. The issue is resolved in version 3.7.2.

References