PT-2026-42023 · Joplin · Joplin

Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-34600

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.5.3

Description A logic error in the delta API allows share recipients to download notes that are no longer shared with them. In the ChangeModel.delta function, when DELTA INCLUDES ITEMS is enabled, the latest state of items is attached to the delta output without verifying if the requesting user still has access, as the removal logic only filters items deleted for all users. Furthermore, the change compression logic incorrectly reduces a create-delete sequence to a NOOP (No Operation). Because compression is applied per page, if an earlier create event is on a different page than a subsequent create-delete pair, the deletion is dropped. This causes the delta API to return a create event for a deleted item including its full latest content.

Recommendations Update to version 3.5.3.

Exploit

Fix

Improper Preservation of Permissions

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-281

CWE-200

CWE-863

Related Identifiers

CVE-2026-34600

Affected Products

Joplin

References · 6

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34600 · Security Note
• https://github.com/laurent22/joplin/issues/14110 · Note
• https://github.com/laurent22/joplin/pull/14289 · Note
• https://t.me/cveNotify/164132 · Telegram Post
• https://t.me/CVEtracker/54302 · Telegram Post