Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-21T22:16:56.890Z",
  "pubdate": "2026-09-21T22:16:56.890Z",
  "executiveSummary": "Joplin Server is vulnerable to an authentication bypass flaw in the SAML implementation, specifically within the UserModel.ssoLogin() function. Prior to version 3.7.2, the application fails to validate the 'is_external' flag when mapping IdP-asserted identities to existing local accounts.\nThis vulnerability allows an attacker capable of controlling or manipulating an identity provider (IdP) session to authenticate as a local, non-SAML user without knowledge of their local credentials. By asserting the email address of a target local user, an attacker can coerce the system into granting a session associated with the victim's account.\nThe risk is critical in hybrid environments where both local authentication and SAML are enabled. Successful exploitation grants the attacker full access to the victim's notes, sensitive files, and account settings. The flaw effectively collapses the boundary between SSO-managed identities and local accounts, leading to unauthorized account takeover.\nThere are no requirements for local password knowledge; the exploitation relies solely on the ability to trigger a match between an IdP-asserted email and an existing local account that was never intended to be associated with an external SSO provider.",
  "technicalDetails": "The vulnerability resides in the UserModel.ssoLogin() function within the Joplin Server backend, responsible for processing SAML assertions. The logic governing account linking fails to perform a validation check on the 'is_external' attribute of the user record when matching an IdP-provided email address.\nIn a secure implementation, an account identified as a 'local' user should be restricted from being authenticated via an external SAML assertion, as these account types are intended to be governed solely by local credentials. However, the affected code blindly accepts the IdP assertion if the email matches a local user record.\nThe attack flow begins when an attacker initiates an authentication request via the POST /api/saml endpoint. The attacker must possess or be able to influence an IdP session that asserts an email address corresponding to a target account on the Joplin Server. Because the application logic prioritizes the email match within UserModel.ssoLogin() without verifying if the target account is permitted to use SSO (the is_external flag), it returns an active session token for the victim's account.\nUpon successful invocation, the server generates an authenticated session cookie or token associated with the local user's security context. This bypasses the necessity for the victim's password entirely. The attacker effectively performs an account takeover, gaining full read and write access to the victim's data, including sensitive notes, file attachments, and synchronization settings.\nThis vulnerability affects all Joplin Server installations prior to version 3.7.2 that utilize a hybrid authentication model. It requires the service to be exposed to a SAML provider and assumes that the attacker can present an assertion matching a registered user. The lack of validation on the account's external status ensures that any local user—even those never configured for SSO—is exposed to this identity injection attack.\nThe root cause is a failure in authorization logic where the application fails to distinguish between internal identity state (is_external=false) and external identity claims, resulting in an improper trust relationship between the IdP assertion and the internal account database."
}