Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T22:16:57.207Z",
  "pubdate": "2026-09-21T22:16:57.207Z",
  "executiveSummary": "Joplin Server versions prior to 3.7.7 contain an authorization vulnerability in the ItemModel.checkIfAllowed() function. This flaw allows low-privileged authenticated users to bypass access control checks regarding shared folder permissions.\nThe vulnerability occurs because the system fails to verify the ShareUserStatus.Accepted state before permitting write operations. An attacker with a pending share invitation can exploit this logic to inject arbitrary items into shared folders.\nThe impact is significant, as the server's ShareModel.updateSharedItems3() function propagates these unauthorized items to the folder owner and all other accepted participants immediately upon injection.\nThis represents a critical failure in access control, allowing an unauthorized participant to influence or compromise the integrity of shared notes and to-do lists before officially joining the collaboration group. Exploitation requires authenticated access to the Joplin Server and an active, albeit unaccepted, invitation to a shared resource.\nOrganizations relying on Joplin Server for collaborative note-taking should prioritize upgrading to version 3.7.7 or later to enforce proper authorization checks for shared items.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient authorization logic within the ItemModel.checkIfAllowed() method in the Joplin Server codebase. When evaluating write permissions for an item associated with a specific share ID, the logic erroneously validates access based solely on the existence of a corresponding entry in the share_users table, irrespective of the user's current status.\nThe application fails to perform a mandatory check for the ShareUserStatus.Accepted constant, which is intended to restrict write operations to users who have explicitly confirmed participation in the shared folder.\nThe exploitation flow proceeds as follows: 1. An attacker identifies a share ID for which they hold a pending invitation. 2. The attacker crafts a malicious request to create or modify an item associated with that share ID. 3. The ItemModel.checkIfAllowed() function executes and detects the attacker's presence in the share_users table for that ID, incorrectly granting write authorization due to the missing status validation. 4. Upon successful write, the system invokes ShareModel.updateSharedItems3().\nBecause ShareModel.updateSharedItems3() is designed to synchronize shared content across all participants, it treats the attacker's injected item as legitimate and immediately propagates the data to the folder owner and all fully authorized members. This allows the attacker to push arbitrary content into a target's workspace before the invitation is ever accepted.\nThe affected component is the internal sharing authorization logic within Joplin Server versions prior to 3.7.7. The vulnerability is restricted to authenticated users but requires no specific administrative privileges, only the receipt of a folder-share invitation. Because the propagation mechanism is automated, the injected content bypasses standard collaborative workflows, potentially leading to unauthorized data modification or social engineering if the attacker injects malicious or misleading notes into a shared environment."
}