Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T21:17:05.463Z",
  "pubdate": "2026-09-21T21:17:05.463Z",
  "executiveSummary": "Joplin Server versions prior to 3.7.2 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the item retrieval mechanism.\nThe vulnerability allows an authenticated attacker to bypass authorization checks, enabling the unauthorized extraction of sensitive note and to-do content belonging to other users.\nThis flaw exists because the GET /items/:id/content route fails to perform ownership validation before serving requested data.\nAn attacker with a valid user account can access arbitrary items if they can ascertain the corresponding item ID, which is a significant breach of data confidentiality.\nThe impact is critical for deployments where end-to-end encryption is not enabled, as the server serves the raw content directly.\nExploitation requires the attacker to be authenticated to the Joplin Server and to possess the target item ID, which may be discovered via enumeration or other side-channel discovery methods.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the Joplin Server application logic, specifically located in packages/server/src/routes/index/items.ts.\nThe affected route, GET /items/:id/content, is responsible for retrieving the content of a specific note or item based on a provided unique identifier. The root cause of this vulnerability is the absence of an ownership verification step that should confirm the requesting user's identity against the owner of the item prior to data retrieval.\nUnder normal operating conditions, the application should query the database to verify that the :id provided in the URI belongs to the user currently authenticated in the session. However, the existing code executes the fetch operation directly based on the attacker-supplied ID, effectively treating the request as authorized solely based on the user's presence within the system.\nTo exploit this, an authenticated attacker sends a crafted GET request to /items/:id/content, substituting :id with the target identifier. If the target note or item is not protected by end-to-end encryption, the server processes the request and returns the decrypted content directly to the attacker's client.\nBecause the server lacks a cross-reference between the session-based UserID and the Item-OwnerID, the application fails to restrict access to items outside the attacker's personal scope. This facilitates unauthorized data access across the platform's multi-tenant architecture.\nThe exploit flow is: 1) The attacker authenticates to their own Joplin Server account; 2) The attacker identifies or guesses an item ID belonging to another user; 3) The attacker submits a malicious GET request to the vulnerable endpoint; 4) The server validates the attacker's authentication status but fails to validate ownership of the requested item; 5) The server returns the sensitive content of the target item in the response.\nThe scope of this vulnerability covers all non-E2EE encrypted data hosted on the server, significantly impacting organizations or individuals that rely on server-side security controls as a primary layer of data protection."
}