Vulnerability Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/laurent22/joplin/commit/b6d69d072919cbe769234f93d95ed21e1ec12
- https://github.com/laurent22/joplin/pull/15647
- https://github.com/laurent22/joplin/security/advisories/GHSA-5px3-4f5x-hjc5
FAQ
What is CVE-2026-55210?
CVE-2026-55210 is a vulnerability with a CVSS score of 7.4 (HIGH). Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an...
How severe is CVE-2026-55210?
CVE-2026-55210 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55210?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.