Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-59815— Joplin: Pending share recipients can write items into shared folders before accepting invitations

Quick assessment

Affected
laurent22 joplin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, with

CVSS 4.3 · Medium EPSS 0.19% · P9

Affected Version Matrix 1

VendorProduct Version RangeStatus
laurent22 joplin < 3.7.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59815

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joplin: Pending share recipients can write items into shared folders before accepting invitations
Source: CVE Program / CVE List V5
Vulnerability Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
laurent22 joplin < 3.7.7 -

II. Public POCs for CVE-2026-59815

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59815

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59815 (1)

Other References for CVE-2026-59815 (1)

Same Patch Batch · laurent22 · 2026-09-21 · 11 CVEs total

CVE-2026-46649 9.1 CRITICAL Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable v
CVE-2026-55105 7.7 HIGH Joplin: Fountain embeds allow arbitrary script execution in published notes and the note v
CVE-2026-59814 7.6 HIGH Joplin: Stored XSS via inline-served note attachment on published shares
CVE-2026-55210 7.4 HIGH Joplin: SAML SSO account takeover via email-based account linking (missing is_external che
CVE-2026-49450 7.1 HIGH Joplin desktop Windows auto-updater accepts signed installer from any publisher because ap
CVE-2026-49453 7.0 HIGH Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource
CVE-2026-55179 6.5 MEDIUM Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its int
CVE-2026-46650 4.4 MEDIUM Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
CVE-2026-59816 4.3 MEDIUM Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
CVE-2026-49449 2.5 LOW Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft

IV. Related Vulnerabilities

Same product: joplin
Same vendor: laurent22
Same weakness: CWE-863

V. Comments for CVE-2026-59815

No comments yet

Leave a comment