CVE-2026-49450

Executive Summary

CVE-2026-49450 is a signature-verification bypass in Joplin Desktop for Windows prior to version 3.7.2. Because publisherName is omitted from packages/app-desktop/package.json, the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer against Joplin's signer.

Affected systems are Windows desktop installations of Joplin that use the built-in auto-update mechanism. An attacker who controls the update delivery path can substitute update metadata and an installer that is signed by a different publisher or left unsigned; after the user approves installation, the payload executes with the user's privileges, enabling compromise of notes, stored credentials, and local data. CVSS v3.1 base score is 7.1 (High); EPSS is not yet scored by FIRST.org; the issue is not listed in CISA KEV.

Technical Analysis

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Joplin Desktop for Windows uses Electron's auto-update subsystem. Prior to version 3.7.2, publisherName is omitted from packages/app-desktop/package.json. This omission propagates into the generated app-update.yml file that drives update resolution.

The Windows installer component NsisUpdater.verifySignature() is responsible for validating that a downloaded update's Authenticode signer matches Joplin's configured signer. Because the expected publisher identity is absent from app-update.yml, the signer comparison does not occur — the verification routine effectively skips the check rather than failing closed. This is a canonical CWE-345 (Insufficient Verification of Data Authenticity) condition: an authenticity control exists in code but is rendered inert by missing configuration.

The practical consequence is that the integrity of the update channel is not cryptographically bound to the Joplin publisher identity. Any actor positioned to influence the update delivery path (for example, via a compromised or spoofed update endpoint, an on-path attacker, or a manipulated update channel) can present replacement update metadata and an installer that is either signed by a different publisher or unsigned. The client will not detect the publisher mismatch, so the substituted artifact can proceed to installation once the user approves the installation prompt.

The attack requires user interaction (UI:R) to approve the installation, and successful delivery depends on controlling the update path, which is reflected in the elevated Attack Complexity (AC:H) of the CVSS vector. The attack vector is Adjacent (AV:A) in the CVSS assessment, with no privileges required (PR:N) and scope unchanged (S:U). Confidentiality, Integrity, and Availability impacts are all High (C:H/I:H/A:H).

The vulnerability class — insufficient verification of a software update's authenticity — is a well-understood supply chain weakness. The defect is not a memory-safety issue and does not require a crafted network packet or malicious document; the vulnerable condition is the absence of a publisher identity configuration value that the updater relies upon for signer comparison.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-49450. The attack chain below is inferred strictly from the vulnerability class (CWE-345) and the mechanism described in the NVD description. No implementation details beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies Windows hosts running Joplin Desktop versions prior to 3.7.2 that rely on the built-in auto-update path, and identifies the update delivery path (endpoint, channel, or metadata source) that the client resolves updates from. Target identification can consider the fact that publisher identity is not enforced, so any signer or unsigned binary is acceptable to the client.

2. Triggering the flawed verification. The attacker gains control of the update delivery path and replaces the update metadata (app-update.yml-driven resolution) and the installer artifact. Because publisherName is omitted prior to 3.7.2, NsisUpdater.verifySignature() skips comparison of the downloaded update's Authenticode signer against Joplin's signer. The substituted installer may therefore be signed by another publisher or delivered unsigned.

3. Payload / execution method at the vulnerability-class level. The attacker delivers an attacker-controlled NSIS installer through the manipulated update channel. When the client presents the update and the user approves installation (UI:R), the signature-verification bypass allows installation to proceed without a publisher mismatch rejecting it. The payload executes with the user's privileges.

4. Post-exploitation impact. Successful exploitation runs attacker-controlled code with the user's privileges. Consistent with the High Confidentiality and Integrity impacts in the CVSS vector, this can compromise notes, credentials, and local data on the affected host. Availability impact is also rated High in the vector.

Impact Assessment

The CVSS v3.1 base score is 7.1 (High), vector CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Key subscores:

• Attack Vector — Adjacent (A): delivery depends on the attacker's position relative to the update delivery path rather than the public internet at large.
• Attack Complexity — High (H): the attacker must control or influence the update delivery path, which is a non-trivial precondition.
• Privileges Required — None (N): no prior authentication on the target is required to craft the malicious update.
• User Interaction — Required (R): the user must approve the installation of the update.
• Scope — Unchanged (U): the impact stays within the security authority of the vulnerable component as scored.
• Confidentiality / Integrity / Availability — High / High / High: compromise of notes, credentials, and local data, with code execution under the user's privileges.

Business impact centers on endpoint data exposure and integrity loss: an attacker who succeeds can read, modify, or destroy note content and access credentials and local data on the affected workstation. Blast radius is limited to endpoints where the attacker can influence the update path and where the user approves installation, but within a single endpoint the impact is severe. Because the updater no longer enforces publisher identity prior to 3.7.2, the update mechanism itself becomes a trusted execution vector for the attacker's payload. Data integrity of note repositories and any secrets stored locally should be treated as suspect after a successful compromise.

Detection Guidance

Detection for this CVE is behavioral and endpoint-centric. There is no malformed network request or signature-based network indicator inherent to the flaw: the abuse signal is an unexpected update being downloaded and installed by Joplin, an installer process launched by the Joplin updater, and post-install child processes. The rules below target those behaviors and should be tuned to the environment. Because no public PoC exists, these rules are heuristic and require validation in a test environment before production deployment.

Sigma Rule

title: Joplin Desktop Updater Executes Non-Joplin-Signed Installer (CVE-2026-49450)
id: 8f4c1a2e-4945-4c7a-9b3d-202649450001
status: experimental
description: Detects Joplin Desktop for Windows launching or executing an update installer where the updater is expected to skip publisher signer comparison, per CVE-2026-49450.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-49450
author: valtersit.com
date: 2026-05-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Joplin.exe'
      - '\joplin.exe'
  selection_child:
    Image|endswith:
      - '\nsis.exe'
      - '.tmp'
  selection_temp_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  condition: selection_parent and (selection_child or selection_temp_path)
falsepositives:
  - Legitimate Joplin auto-updates installing a signed Joplin release
level: high
tags:
  - attack.t1195.002
  - cve.2026.49450

YARA Rule

rule CVE_2026_49450_Joplin_Update_Publisher_Missing
{
    meta:
        description = "Detects app-update.yml update metadata lacking publisherName, consistent with CVE-2026-49450 in Joplin Desktop for Windows"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49450"
        date = "2026-05-01"
        severity = "high"

    strings:
        $yml_header = "provider:" ascii nocase
        $yml_url    = "url:" ascii nocase
        $yml_chan   = "channel:" ascii nocase
        $publisher  = "publisherName" ascii nocase

    condition:
        filesize < 64KB and
        $yml_header and $yml_url and ($yml_chan or $publisher) and
        not $publisher
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49450 Joplin Update Metadata Request (app-update.yml)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"app-update.yml"; nocase; http.host; content:"joplin"; nocase; classtype:policy-violation; reference:cve,2026-49450; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49450; sid:2026494501; rev:1;)

Elastic Detection

sequence by host.id with maxspan=10m
  [process where event.type == "start" and process.name : "Joplin.exe"] with runs=1
  [process where event.type == "start" and
     (process.parent.name : "Joplin.exe" or process.parent.name : "joplin.exe") and
     (process.executable : ("*\\Temp\\*", "*\\AppData\\*") or
      process.name : ("nsis.exe", "*.tmp"))]

Splunk SPL Query

index=endpoint sourcetype=WinEventLog:Security EventCode=4688
| eval parent=lower(ParentProcessName), child=lower(NewProcessName)
| where (parent="*\\joplin.exe" OR parent="*\\joplin-updater*")
        AND NOT (child="*\\joplin.exe" OR child="*program files*\\joplin*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as cmdlines by ComputerName, parent, child
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="windows,cve-2026-49450,">
  <rule id="20264950" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)\\Joplin\.exe$</field>
    <field name="win.eventdata.image">(?i)(\\AppData\\|\\Temp\\|nsis\.exe|\.tmp)</field>
    <description>CVE-2026-49450: Joplin updater spawned a non-Joplin installer from a temporary/AppData path, possible update signature bypass</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>cve_2026_49450,supply_chain,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Although the NVD description states the issue is fixed in version 3.7.2, no patch evidence is available from tracked sources for this entry, so patch confidence is 0/4.

1. Immediate mitigations.

   • Disable the built-in auto-update function on Joplin Desktop for Windows until the fixed build (3.7.2 or later) is deployed, and perform updates through an externally verified, administrator-controlled channel.
   • Restrict network access from Joplin endpoints to a trusted update endpoint where feasible, so an attacker cannot easily position themselves on the update delivery path.
   • Do not approve unexpected update installation prompts; instruct users to report unexpected Joplin update dialogs.
   • Apply application allow-listing so only signed, organisation-approved installers can execute, compensating for the skipped publisher check.

2. Patch/upgrade steps.

   • Upgrade Joplin Desktop for Windows to version 3.7.2 or later, which is identified in the description as the fixed version.
   • Verify the installed version after upgrading and confirm the update channel no longer permits installation of non-Joplin-signed artifacts.
   • Where centralised software management is used, push the fixed package rather than relying on in-app self-update.

3. Long-term hardening.

   • Treat update-channel integrity as a supply-chain control: validate that updater configuration includes publisher identity and that missing values fail closed.
   • Enforce code-signing and publisher verification at the endpoint (e.g., via WDAC/AppLocker) so that even a bypassed in-app check does not permit unsigned or foreign-signed installers to run.
   • Monitor for update-process anomalies (parent/child relationships, installers launched from Temp or AppData) and alert on deviations.

References

• NVD — CVE-2026-49450: https://nvd.nist.gov/vuln/detail/CVE-2026-49450
• MITRE CWE-345 — Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
• MITRE ATT&CK T1195.002 — Compromise Software Supply Chain: https://attack.mitre.org/techniques/T1195/002/
• Joplin project repository and release notes (reference the fixed release 3.7.2 on the official Joplin distribution channel): https://joplinapp.org/
• CISA Known Exploited Vulnerabilities catalog (check current listing status; CVE-2026-49450 is not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template has been observed for CVE-2026-49450. No threat actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing, and the CVE is not in CISA KEV. EPSS has not yet been scored by FIRST.org.