CVE-2026-105785

Executive Summary

CVE-2026-105785 is a token-purpose confusion vulnerability in Joplin Server prior to version 3.7.2, where CSRF, account-confirmation, email-change, and password-reset tokens are stored without a type discriminator. Because UserModel.resetPassword accepts any token returned by TokenModel.userFromToken, an attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint to take over the account. The CVSS score is 4.8 (Medium), and the flaw is rated high attack complexity precisely because exploitation depends on an out-of-band token disclosure step.

Technical Analysis

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks, and Joplin Server provides the synchronization and account backend. The vulnerability resides in the server-side token model at packages/server/src/models/TokenModel.ts, which persists CSRF, account-confirmation, email-change, and password-reset tokens without storing an associated purpose field. As a consequence, tokens generated for one workflow are structurally indistinguishable from tokens generated for another — the database record lacks the metadata needed to enforce workflow scoping at verification time.

The exploitable consequence is in packages/server/src/models/UserModel.ts. The UserModel.resetPassword routine accepts any token returned by TokenModel.userFromToken, meaning that a token minted for a CSRF validation step or an account-confirmation step will satisfy the reset-password flow just as a legitimate password-reset token would. This is a classic CWE-620 (Unverified Password Change) condition: the password-change path does not verify that the actor presenting the token is the legitimate owner of the reset flow, nor that the token was ever intended for that flow.

The attack surface is the public password-reset endpoint exposed by Joplin Server, which is reachable over the network (AV:N). The vulnerability is not a direct authentication bypass — it does not allow an attacker to mint a valid token from nothing. It is a token-reuse/confusion flaw that requires the attacker to already hold a token belonging to the victim, obtained via a separate disclosure channel (token leakage, log exposure, referer leakage, misconfigured proxy, XSS that exfiltrates a CSRF value, or an email-forwarding misconfiguration). It is this dependency on a prior disclosure that drives the High attack-complexity metric (AC:H) and the absence of Privileges Required (PR:N) — no authenticated session is needed to submit the token.

Notably, per the NVD description, a successful reset does not merely change the password: it also deletes the victim's existing sessions and API applications, which is a deliberate security measure of the reset flow that the attacker turns into a lockout/DoS amplifier. No public proof-of-concept, exploit code, or Nuclei template is currently known for this CVE, and no attribution to a named threat actor exists in available data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description. It is important for defenders to note that exploitation is conditional: the attacker must first acquire a victim-scoped token from a disclosure channel outside the vulnerable endpoint itself.

1. Reconnaissance / target identification. The attacker identifies a reachable Joplin Server instance below version 3.7.2. This is typically an internet-facing sync/account backend that presents the Joplin Server login and account-management UI. Version fingerprinting can be attempted via response headers, asset wording, or known static resource paths; the specific build may also be inferred from behaviour of public endpoints.

2. Token acquisition (the precondition). The attacker must obtain a CSRF token or an account-confirmation token belonging to the victim through a separate disclosure channel. This is the High-complexity step in the CVSS vector. Candidate channels — consistent with the flaw class, not with any specific disclosed incident — include token leakage through logs or analytics, tokens exposed in referrer headers or cached URLs, cross-site scripting on a related origin that exfiltrates a token value, insecure email forwarding or shared mailbox access, or a misconfigured reverse proxy that caches account-confirmation links. Without this step the flaw is not exploitable.

3. Triggering the flaw class. Because TokenModel.ts stores no purpose field, the acquired token is indistinguishable in the database from a password-reset token. The attacker submits the stolen CSRF/confirmation token to the public password-reset endpoint. UserModel.resetPassword, which accepts any token returned by TokenModel.userFromToken, validates the token successfully and proceeds with the password change instead of rejecting it as out-of-scope for that flow. No code-level bypass, crafted payload, or memory manipulation is required — the endpoint simply mis-trusts the token's origin.

4. Post-exploitation impact. The attacker sets a new password for the victim account. Per the NVD description, this action also causes the victim's existing sessions and API applications to be deleted. The attacker thereby gains control of the account (Confidentiality impact at Low per the vector), can read or modify the victim's synchronized notes and lists (Integrity impact at Low), and simultaneously denies the legitimate user access to their own data by invalidating their live sessions and API credentials — a self-inflicted lockout that doubles as an availability-pressure side effect. Availability is scored None in the vector because the removal of sessions is part of the intended reset semantics rather than a persistent denial of data.

Defenders should treat any observed submission of a token that was originally issued for a CSRF or account-confirmation workflow directly to the password-reset endpoint as a strong indicator of exploitation.

Impact Assessment

The blast radius is confined to Joplin Server deployments below version 3.7.2 that expose the public password-reset endpoint and whose users can have their tokens disclosed through any secondary channel. Because no authentication is required to submit the reset (PR:N), a remote unauthenticated attacker who has completed the disclosure precondition can complete account takeover of any affected user. The CVSS vector reports Low Confidentiality (C:L) and Low Integrity (I:L) with Availability None (A:N), reflecting that the attacker gains account access to synchronized note data rather than full server compromise, and that the loss of sessions/API applications is an intended side effect rather than scored availability impact. The High attack-complexity metric (AC:H) is the primary downward pressure on the 4.8 base score and reflects the out-of-band token-disclosure requirement.

For an organisation, the realistic business impact is unauthorised access to synced notes, to-do lists, and any credentials or operational detail users store in them, combined with disruption to the victim while they recover access. Because API applications are deleted on reset, automation or integrations bound to the victim account also stops, which can break downstream sync jobs until re-provisioned. This vulnerability is not listed on CISA KEV, no public exploit exists, and no EPSS score has been published by FIRST.org — so exposure is best assessed via inventory rather than probability-of-exploit feeds.

Detection Guidance

Sigma Rule

title: Suspicious Joplin Server Password Reset Using Non-Reset Token
id: 6f2c1d47-9a3e-4b1f-8c2a-0b5e7a9c1f10
status: experimental
description: Detects password-reset submissions to Joplin Server immediately followed by session/API-application deletion, indicative of CVE-2026-105785 token-purpose confusion.
author: valtersit.com
logsource:
  product: joplin
  service: server
detection:
  selection_reset:
    event|contains: 'resetPassword'
  selection_token:
    event|contains:
      - 'token'
      - 'TokenModel'
  selection_session_del:
    message|contains:
      - 'session'
      - 'api application'
  condition: selection_reset and selection_token and selection_session_del
falsepositives:
  - Legitimate password resets by users who deliberately regained access
level: medium
tags:
  - attack.t1078
  - attack.t1190
  - cve.2026.105785

YARA Rule

rule CVE_2026_105785_Joplin_Token_Purpose_Confusion
{
    meta:
        author = "valtersit.com"
        description = "Detects Joplin Server source patterns characteristic of token purpose confusion (CVE-2026-105785)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105785"
        cve = "CVE-2026-105785"
        date = "2026-01-01"

    strings:
        $model = "TokenModel" ascii
        $model_file = "TokenModel.ts" ascii
        $user_model = "UserModel" ascii
        $user_model_file = "UserModel.ts" ascii
        $reset = "resetPassword" ascii
        $from_token = "userFromToken" ascii
        $purpose = "purpose" ascii nocase
        $csrf = "csrf" ascii nocase
        $confirm = "account-confirmation" ascii nocase
        $emailchange = "email-change" ascii nocase

    condition:
        (
            ($model_file or $user_model_file) and
            ($reset and $from_token)
        ) or
        (
            $model and $user_model and
            $reset and
            not $purpose and
            ($csrf or $confirm or $emailchange)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105785 Joplin Server Token-Purpose Confusion Password Reset Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"password"; http.uri; content:"reset"; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; pcre:"/(password|token)=/Ui"; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-105785; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-105785; sid:2026105785; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [http where http.request.method == "POST" and
     wildcard(http.request.uri, "*password*reset*") and
     wildcard(http.request.uri, "*token*")]
  [authentication where wildcard(event.action, "*session*") or
     wildcard(event.action, "*api_application*") and
     event.outcome == "success"]

Splunk SPL Query

index=joplin_server sourcetype=joplin:http ("resetPassword" OR "password-reset" OR "/api/password")
| stats count min(_time) as first_time max(_time) as last_time by src_ip, user, uri, status
| where status=200 AND count >= 1
| eval first_time=strftime(first_time,"%Y-%m-%dT%H:%M:%S"), last_time=strftime(last_time,"%Y-%m-%dT%H:%M:%S")
| sort - count
| table first_time last_time src_ip user uri status count

Wazuh OSSEC Rule

<group name="joplin,cve-2026-105785,">
  <rule id="100785" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">joplin-server</field>
    <match>resetPassword|password-reset</match>
    <description>CVE-2026-105785: Joplin Server password reset may be using a non-reset token</description>
    <mitre>
      <id>T1078</id>
      <id>T1190</id>
    </mitre>
    <group>attack,authentication,</group>
  </rule>
  <rule id="100786" level="12">
    <if_sid>100785</if_sid>
    <match>session deleted|api application deleted|sessions removed</match>
    <description>CVE-2026-105785: Joplin Server session/API application deletion following suspicious password reset</description>
    <mitre>
      <id>T1531</id>
    </mitre>
    <group>attack,impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There are no entries in the vendor-fix, workaround, or affected-version datasets returning positive evidence; the fix is documented as available in Joplin Server 3.7.2, but no tracked source in the associated data has confirmed the patch, so treat the deployment as unpatched until independently verified.

1. Immediate mitigations (before upgrade):

• Treat any token issued by the Joplin Server as a bearer credential and restrict its exposure: eliminate token values from access logs, analytics, error tracking, and referrer headers. This directly attacks the disclosure precondition that makes the High-complexity exploit feasible.
• Restrict network exposure of the Joplin Server password-reset endpoint to trusted networks wherever possible, and add rate limiting and abuse throttling. Because exploitation requires submitting a token to the reset endpoint, limiting and monitoring that path reduces both success probability and detection latency.
• Apply WAF or reverse-proxy rules matching the Suricata pattern above (POST to password/reset with token fields), with alerting rather than silent blocking, to surface attempts during the pre-patch window.
• Audit mail-forwarding and shared-mailbox rules for users: account-confirmation links delivered by email are a prime disclosure channel for the precondition step.
• Enforce multi-factor and short session lifetimes where supported to reduce the value of a single account takeover pending upgrade.

2. Patch / upgrade steps:

• Upgrade Joplin Server to 3.7.2 or later, which is documented as the fixed release.
• Because no patch source is confirmed in tracked data, verify the upgrade by confirming the server build version from the running instance after deployment — do not rely solely on package metadata.
• After upgrading, force a review of any password changes or session invalidation events that occurred during the exposure window, and notify affected users to reset credentials through trusted channels.

3. Long-term hardening:

• Adopt a token schema that binds every token to an explicit purpose (CSRF, confirmation, email-change, reset) and enforce purpose checks at verification time, so that TokenModel.userFromToken-style lookups cannot be satisfied by a token from an unrelated workflow. This is the structural fix for CWE-620.
• Add regression tests asserting that a CSRF or confirmation token is rejected by the password-reset flow.
• Include secret-scrubbing in logging and telemetry pipelines, and monitor for tokens appearing in URLs, referrers, and third-party scripts.
• Track future Joplin Server releases and maintain a verified vulnerability-inventory entry for this CVE until a tracked patch source publishes confirmation.

References

1. NVD — CVE-2026-105785: https://nvd.nist.gov/vuln/detail/CVE-2026-105785
2. CWE-620 — Unverified Password Change: https://cwe.mitre.org/data/definitions/620.html
3. Joplin project — Joplin Server release 3.7.2 (official release channel) — verify via the Joplin Foundation repository and its server release notes.
4. FIRST.org EPSS — no score currently published for CVE-2026-105785.