CVE-2026-105786

Executive Summary

CVE-2026-105786 is a missing-authentication flaw (CWE-306) in the Joplin Server application authorization flow affecting versions prior to 3.7.13. The server accepts a caller-supplied application authorization identifier, binds it to a logged-in victim through a generic consent page, and redeems it at a public API endpoint without authenticating or binding the redeeming party. An attacker who convinces a victim to approve the attacker's identifier can obtain a durable application ID and password that yields a session with full read and write access to the victim's synchronized data.

Technical Analysis

Joplin is an open source note-taking and to-do application that organizes notes and lists into notebooks. The vulnerability resides in the server-side application authorization logic. Prior to 3.7.13, three components interact insecurely:

1. packages/server/src/models/ApplicationModel.ts — accepts a caller-chosen application authorization identifier. The identifier is not generated server-side or cryptographically bound to the requesting party, so an attacker can select an arbitrary value in advance.
2. applications/:id/confirm — binds that caller-chosen identifier to a logged-in user via a generic consent page. The consent page does not meaningfully differentiate the true originator of the authorization request; the victim approves an identifier that the attacker controls.
3. packages/server/src/routes/api/application_auth.ts — a public endpoint that passes the identifier to ApplicationModel.createAppPassword without authenticating or binding the redeemer. The endpoint is the redemption step, and because it neither authenticates the caller nor verifies that the caller is the same party who initiated the request, anyone holding the identifier can redeem it.

The net weakness class is CWE-306: Missing Authentication for Critical Function. The authorization flow conflates "the user approved an identifier" with "the user approved this specific application," and the redemption endpoint treats possession of an approved identifier as sufficient authorization. There is no cryptographic binding between the initiator of the authorization request, the approved identifier, and the redeemer. Consequently, the security decision rests entirely on a generic consent action that leaks authorization to whichever party first redeems the identifier.

Because the redeemed credential is described as a durable application ID and password, the resulting access persists until the application credential is revoked or expires. The exchanged credential yields a victim session with full read and write access to synchronized data, meaning any data the user synchronizes through Joplin Server can be read, modified, or destroyed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the components named in the NVD description.

1. Reconnaissance / target identification. The attacker locates a reachable Joplin Server instance hosting synchronization data for one or more users. The attacker must identify a victim who is logged in to that server and can be induced to visit a consent page.

2. Triggering the flaw class. The attacker chooses an application authorization identifier (the value is caller-controlled through ApplicationModel.ts). The attacker then causes the victim to visit applications/:id/confirm and approve the attacker's identifier on the generic consent page. The approval binds the attacker's chosen identifier to the victim's logged-in account, even though the victim did not intend to authorize the attacker's application.

3. Payload / execution method (class level). With the identifier now bound, the attacker calls the public packages/server/src/routes/api/application_auth.ts endpoint and passes the identifier. Because the endpoint neither authenticates the caller nor binds the redeemer, it forwards the identifier to ApplicationModel.createAppPassword, which mints a durable application ID and password for the attacker.

4. Post-exploitation impact. The attacker exchanges the application ID and password for a victim session and gains full read and write access to the victim's synchronized data. The credential is durable, so access survives the initial interaction and persists until revoked.

The critical enabler is user interaction: the victim must approve the attacker-controlled identifier. This is a consent-phishing / authorization-confusion pattern rather than a pre-authentication remote code path.

Impact Assessment

• Confidentiality (High): Full read access to synchronized notes and lists.
• Integrity (High): Full write access — data can be modified, injected, or deleted.
• Availability (None specified in data): No denial-of-service mechanism is described; however, destructive writes to synchronized data could effectively deny access to notes.
• Scope (Changed): The attacker's authorization context is meaningful only because the victim approves it, and the redeemed credential operates with the victim's privileges — a boundary crossing consistent with a changed scope.
• Attack vector (Network): Exploitable remotely against public Joplin Server endpoints.
• Privileges required (None): The attacker needs no prior account on the target server.
• User interaction (Required): The victim must approve the attacker's identifier.
• CVSS score: N/A — no official score is published in the provided data; the vector above is an analytical estimate only and should not be treated as an authoritative score.

Blast radius is bounded by the victim's synchronized dataset and the set of applications the victim is willing/able to approve. It is not, per available data, a server-wide compromise of all users. Even so, note contents frequently contain credentials, tokens, and internal documentation, making this a high-value target for espionage and follow-on intrusion.

Detection Guidance

Sigma Rule

title: Joplin Server Application Authorization Redemption Without Authentication
id: 9f2a7c41-1b6e-4d8a-9c3f-joplin105786
status: experimental
description: Detects access to the Joplin Server public application authorization endpoint (api/application_auth) and use of the applications/:id/confirm consent flow, indicating possible abuse of CVE-2026-105786.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105786
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - 'api/application_auth'
      - 'applications/'
  selection_confirm:
    cs-uri-stem|contains:
      - '/confirm'
  condition: selection_endpoint and selection_confirm
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate application authorization flows initiated by the user themselves
level: medium

YARA Rule

rule CVE_2026_105786_Joplin_AppAuth
{
    meta:
        description = "Detects references to the Joplin Server application authorization flow abused by CVE-2026-105786"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105786"
        date = "2026-01-01"
    strings:
        $s1 = "application_auth" ascii nocase
        $s2 = "createAppPassword" ascii nocase
        $s3 = "ApplicationModel" ascii nocase
        $s4 = "applications/" ascii nocase
    condition:
        uint16(0) == 0x5A4D or (2 of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105786 Joplin Server application authorization redemption attempt"; flow:to_server,established; http.uri; content:"/api/application_auth"; http_uri; nocase; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105786; sid:2026105786; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [http where http.request.method == "GET" and wildcard(http.request.uri.path, "*applications/*/confirm*")]
  [http where wildcard(http.request.uri.path, "*api/application_auth*")]

Splunk SPL Query

index=web (cs_uri_stem="*api/application_auth*" OR cs_uri_stem="*applications/*/confirm*")
| stats count values(cs_uri_stem) as uris by src_ip, cs_uri_stem, status
| where count > 0
| table _time, src_ip, uris, status

Wazuh OSSEC Rule

<group name="joplin,cve-2026-105786,">
  <rule id="105786" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url contains="api/application_auth">api/application_auth</url>
    <description>CVE-2026-105786: Possible Joplin Server application authorization redemption (unauthenticated endpoint access)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to the Joplin Server /applications/:id/confirm and /api/application_auth endpoints to trusted networks or authenticated users where feasible.
   • Audit existing application authorizations and revoke any application ID/password the user did not personally create.
   • Educate users not to approve application authorization requests they did not initiate; treat any unexpected consent page as hostile.

2. Patch / upgrade steps

   • The vulnerability is fixed in Joplin 3.7.13. Upgrade to 3.7.13 or later when a build becomes available. Because patch sources are empty and patch confidence is 0/4, verify the fix against the official Joplin release notes before relying on it.
   • After upgrade, rotate application credentials and any data that may have been exposed.

3. Long-term hardening

   • Enforce server-side generation and cryptographic binding of application authorization identifiers so approval cannot be replayed by a different party.
   • Require authentication at the redemption endpoint and verify that the redeemer is the same principal who initiated the authorization request.
   • Replace the generic consent page with one that clearly identifies the requesting application and its origin; log all approvals and redemptions with source IP and identity.

References

• NVD — CVE-2026-105786
• MITRE CWE-306 — Missing Authentication for Critical Function
• MITRE ATT&CK T1190 — Exploit Public-Facing Application
• Joplin project / release notes
• CISA KEV Catalog — CVE-2026-105786 is not listed as exploited in the wild as of this report.