Unauthorized Item Creation Vulnerability in Joplin Server by Laurent Bréban
CVE-2026-59815

4.3MEDIUM

Key Information:

Vendor

Laurent22

Status
Joplin
Vendor
CVE Published:
21 September 2026

What is CVE-2026-59815?

In Joplin Server, a flaw exists in the authorization logic of the ItemModel.checkIfAllowed() function. This vulnerability allows low-privileged authenticated users with a pending folder-share invitation to create items under a share ID. The flaw occurs because the system erroneously validates write permissions based solely on the existence of share_users rows, without confirming that the share user status is accepted. Consequently, injected content can propagate to the item owner and accepted participants via the ShareModel.updateSharedItems3() method before the attacker even accepts the invitation, leading to potential unauthorized access to the shared items. This issue was addressed in Joplin Server version 3.7.7.

Affected Version(s)

joplin < 3.7.7

References

https://github.com/laurent22/joplin/security/advisories/G...
x_refsource_CONFIRM
https://github.com/laurent22/joplin/commit/dff533ccbd2b30...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.