CVE-2026-46649
Severity not reportedJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/laurent22/joplin/commit/fd8c1fb53f98f689e846dc164e39f307f09b684d security-advisories@github.com
- https://github.com/laurent22/joplin/pull/15433 security-advisories@github.com
- https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h security-advisories@github.com
- https://github.com/laurent22/joplin/tree/v3.7.2 security-advisories@github.com
- https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h 134c704f-9b21-4f2e-91b3-4a467353bcc0