CVE-2026-105783

Executive Summary

CVE-2026-105783 is a cross-origin authorization weakness (CWE-346, Origin Validation Error) in Joplin Desktop's opt-in Web Clipper server, present in versions prior to 3.7.13. When the Clipper server is enabled, its pairing endpoints (POST /auth and GET /auth/check) accept requests from arbitrary HTTP/HTTPS origins because the server responds with Access-Control-Allow-Origin: * and does not reject external origins. A victim who approves the generic confirmation dialog — which does not display the requesting origin — permanently authorizes the attacker's page, which then receives the API token granting ongoing read/write access to all notes, folders, tags, resources, and master keys. The vulnerability is rated CVSS 8.0 (High) with a scope change (S:C) and High confidentiality and integrity impact; no public PoC, exploit code, or KEV listing is currently observed, and the patch confidence is 0/4 (unpatched per tracked sources) despite the vendor's stated fix version.

Technical Analysis

Joplin is an open-source note-taking and to-do application that organizes notes and lists into notebooks. Joplin Desktop includes an optional Web Clipper server (implemented in packages/lib/ClipperServer.ts) that allows a browser extension or web page to send captured content into the application. Clipping requires the connecting client to be paired and to hold a persistent API token.

The flaw is an origin validation error in the pairing workflow:

• The Clipper server emits the CORS response header Access-Control-Allow-Origin: *, meaning browser-based cross-origin requests are not restricted to a trusted origin.
• The pairing endpoints POST /auth and GET /auth/check do not reject HTTP or HTTPS origins. Consequently, a page hosted on any web server can initiate a pairing request to the locally running Clipper service.
• After the pairing request is made, Joplin Desktop presents a confirmation dialog to the user. That dialog does not identify the requesting origin. The user sees a generic authorization prompt and, if they approve it, authorizes the attacking page rather than a legitimate extension.
• Upon approval, the attacker-controlled page receives the permanent API token. The token is not origin-scoped, so the attacking page retains ongoing access.

The token grants read and write access to notes, folders, tags, resources, and master keys. Master key access is particularly significant because Joplin supports end-to-end encryption (E2EE); exposure of master keys undermines the confidentiality guarantees that E2EE is intended to provide for the user's synchronized note data.

Root cause: the Access-Control-Allow-Origin: * policy combined with the absence of origin allowlisting on the pairing endpoints, and a confirmation dialog that omits origin information the user would need to make an informed consent decision. No specific request/response body fields, nonce formats, or token formats are disclosed in the available description; the analysis is limited to the endpoints and headers explicitly named. The CVSS vector reflects network reachability (AV:N) with high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), and a scope change (S:C). The user approval step is the interaction requirement, and the scope change reflects the Clipper server acting as a bridge from an untrusted web origin into the desktop application's protected data domain.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-346, origin validation error) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a victim who runs Joplin Desktop with the Web Clipper server enabled. The Clipper service listens locally and is only reachable from a context that can address the local host — typically the victim's own browser. The attacker therefore needs the victim to visit a malicious or compromised web page while Joplin is running, rather than requiring broad internet-facing scanning. Passive constraints here (user must have the opt-in server enabled and be actively browsing) are consistent with the CVSS AC:H rating.

2. Triggering the flaw. The victim visits an attacker-controlled page (malicious site, compromised site, or malicious ad/iframe). The page's script issues a cross-origin request to the local Clipper server's pairing endpoint (POST /auth). Because the server sends Access-Control-Allow-Origin: * and the pairing endpoints do not reject the requesting origin, the browser permits the cross-origin interaction and the request reaches the server.

3. Payload / execution method. The attacking page elicits an approval from the user. Joplin Desktop displays a confirmation dialog that does not identify the requesting origin, so the victim cannot distinguish the malicious page from a legitimate pairing attempt. If the victim approves, the attacking page receives the permanent API token returned through the pairing flow.

4. Post-exploitation impact. Holding the token, the attacker's page (or the server it reports back to) can issue authenticated calls to the Clipper/Clipper-adjacent API and exercise read and write access to notes, folders, tags, resources, and master keys. This yields data exfiltration (note contents and resources), persistence through the permanent token, and tampering (write access). Access to master keys can compromise the confidentiality of E2EE-protected content, extending the blast radius beyond the locally stored notes.

The chain depends on user approval; no evidence of a working exploit, exploit code, or in-the-wild campaign was observed in the provided data.

Impact Assessment

Successful exploitation grants ongoing, authenticated access to the victim's Joplin data estate. Per the CVSS 3.1 vector (8.0):

• Confidentiality: High (C:H) — notes, folders, tags, resources, and master keys can be read and exfiltrated.
• Integrity: High (I:H) — the same token permits write operations, enabling modification or destruction of notes and injection of content.
• Availability: None (A:N) — no availability impact is specified.
• Scope: Changed (S:C) — the vulnerable Clipper server component is used to impact assets (the user's NoteStore data and E2EE keys) beyond the component itself.
• Attack Vector: Network (AV:N), Attack Complexity: High (AC:H), Privileges Required: None (PR:N), User Interaction: Required (UI:R).

Business impact is concentrated on individual knowledge workers and any organization whose personnel store sensitive material in Joplin notebooks — research notes, credentials copied into notes, meeting records, or regulated data. Because the token is permanent, remediation requires affected users to revoke/invalidate the issued token and re-pair only with trusted clients, not merely to close the tab. The master key exposure component means that even encrypted and synchronized vaults may be at risk, undercutting a control (E2EE) that many users rely on as their primary protection. Blast radius is bounded by (a) the opt-in nature of the Web Clipper server and (b) the requirement that the user approve the prompt; it is not a wormable or internet-wide mass-exploitation scenario.

Detection Guidance

Sigma Rule

title: Joplin Web Clipper Cross-Origin Pairing Attempt (CVE-2026-105783)
id: 7f3c9b1e-6a54-4d2b-9f0e-1c8a5d7b2e64
status: experimental
description: Detects HTTP requests to the Joplin Desktop Web Clipper pairing endpoints, which prior to 3.7.13 accepted arbitrary origins (CWE-346).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105783
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: joplin
detection:
  selection_endpoints:
    cs-method|contains:
      - 'GET'
      - 'POST'
    cs-uri-stem|endswith:
      - '/auth'
      - '/auth/check'
  selection_loopback:
    c-ip|startswith:
      - '127.'
      - '::1'
  condition: selection_endpoints and selection_loopback
falsepositives:
  - Legitimate browser extension pairing with the Joplin Web Clipper
level: medium
tags:
  - attack.t1190
  - cve.2026.105783

YARA Rule

rule CVE_2026_105783_Joplin_Clipper_Origin
{
    meta:
        description = "Detects scripts referencing the Joplin Web Clipper pairing endpoints associated with CVE-2026-105783"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105783"
        date = "2026-01-01"

    strings:
        $endpoint1 = "/auth/check" ascii nocase
        $endpoint2 = "/auth" ascii nocase
        $clipper   = "ClipperServer" ascii nocase
        $token     = "api_token" ascii nocase wide
        $acao      = "Access-Control-Allow-Origin: *" ascii nocase

    condition:
        uint16(0) == 0x3C3F or uint32(0) == 0x6D783F3C or true
        and filesize < 2MB
        and (
            ($endpoint1 and $endpoint2)
            or ($endpoint2 and $clipper)
            or ($endpoint1 and $acao)
        )
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-105783 Joplin Web Clipper Cross-Origin Pairing Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/auth"; http.header; content:"Origin"; nocase; http.header; content:"Access-Control-Allow-Origin"; nocase; reference:cve,2026-105783; classtype:attempted-user; sid:2026105783; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [network where network.direction == "outbound"
    and destination.port in (41184, 41185, 41186)]
  [http where url.path in ("/auth", "/auth/check")
    and http.request.method in ("GET", "POST")]

Splunk SPL Query

index=proxy OR index=joplin OR index=web
| search (uri_path="/auth" OR uri_path="/auth/check") AND (method="POST" OR method="GET")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips values(http_user_agent) as user_agents
        by uri_path, method, dest_host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen dest_host src_ips uri_path method count user_agents

Wazuh OSSEC Rule

<group name="joplin,cve-2026-105783,">
  <rule id="202610783" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/auth</field>
    <description>CVE-2026-105783: Joplin Web Clipper pairing request (/auth or /auth/check) observed - cross-origin origin validation error</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.attempted_user,</group>
  </rule>
  <rule id="202610784" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/auth/check</field>
    <field name="http_method">GET</field>
    <description>CVE-2026-105783: Joplin Web Clipper token check from unexpected origin</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.attempted_user,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Patch sources list is empty and no vendor fix string or workaround is recorded in the provided data, despite the NVD description naming 3.7.13 as the fixed version.

1. Immediate mitigations

   • Disable the Web Clipper server in Joplin Desktop when it is not actively needed (Settings → Web Clipper). The vulnerability requires the server to be enabled and the user to approve a pairing prompt.
   • If the Clipper server must remain enabled, avoid browsing untrusted sites in a browser on the same host while it is running, and do not approve pairing or authorization prompts unless the user positively initiated pairing from a known client.
   • Treat any unexpected pairing approval as a compromise: revoke/rotate the issued API token (remove the authorized client in Web Clipper settings) and re-pair only with a trusted browser extension.
   • If master keys may have been exposed, rotate E2EE master keys and re-encrypt the vault per Joplin's documented key-rotation procedure.

2. Patch/upgrade steps

   • Upgrade Joplin Desktop to version 3.7.13 or later, which the vendor states fixes the issue.
   • Because patch confidence from tracked sources is 0/4, verify the fix independently: confirm the installed version reports 3.7.13+, then validate that the Access-Control-Allow-Origin: * response and origin-unrestricted pairing behavior on /auth and /auth/check no longer occur (use a controlled browser test against the local server from a foreign origin).
   • After upgrading, invalidate any tokens issued before the upgrade.

3. Long-term hardening

   • Enforce origin allowlisting on all Clipper pairing endpoints and replace wildcard CORS (Access-Control-Allow-Origin: *) with a strict allowlist of expected origins.
   • Display the requesting origin in the pairing confirmation dialog so consent decisions are informed, and require explicit per-origin user approval.
   • Bind token issuance to the approved origin and scope tokens to least privilege; consider expiring or requiring re-consent for long-lived tokens.
   • Restrict the Clipper server to loopback with origin validation and add rate limiting/monitoring on pairing endpoints to detect repeated or anomalous pairing attempts.
   • Apply defense-in-depth for E2EE: keep master keys out of any web-reachable API surface where feasible, and audit token access as a security-relevant event.

References

• NVD — CVE-2026-105783: https://nvd.nist.gov/vuln/detail/CVE-2026-105783
• Joplin project (vendor): https://joplinapp.org/
• Joplin source — Web Clipper server implementation reference (packages/lib/ClipperServer.ts) as cited in the NVD description
• CWE-346 — Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-105783 is NOT listed as of the data provided; no exploit-in-the-wild or threat actor campaign evidence was observed.