---
id: CVE-2026-59815
title: >-
  Joplin is an open source note-taking and to-do application that organises
  notes and lists into notebooks
summary: >-
  Joplin is an open source note-taking and to-do application that organises
  notes and lists into notebooks. Prior to 3.7.7, Joplin Server's
  ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any
  share_users row exis…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: laurent22
product: joplin
affected:
  - joplin < 3.7.7
published: '2026-09-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T23:17:13.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59815'
references:
  - url: >-
      https://github.com/laurent22/joplin/commit/dff533ccbd2b300eac218a11a7619280865e2e9b
    label: security-advisories@github.com
  - url: >-
      https://github.com/laurent22/joplin/security/advisories/GHSA-qq59-gg3w-pf7v
    label: security-advisories@github.com
  - url: >-
      https://github.com/laurent22/joplin/security/advisories/GHSA-qq59-gg3w-pf7v
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T22:49:21.225152Z'
epss: 0.00232
epssPercentile: 0.12626
ingestedAt: '2026-09-21T21:53:57.432Z'
---

## Overview

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.