PT-2026-42224 · Unknown · Trilium Notes

Drkim-Dev · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-39310

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Trilium Notes versions prior to 0.102.2

Description Trilium Notes is a hierarchical note taking application. In an Electron environment, the Clipper API explicitly disables authentication middleware, allowing a full authentication bypass. This exposes endpoints such as '/api/clipper/notes' to the network without requiring a password, API token, or Cross-Site Request Forgery (CSRF) protection—a mechanism used to prevent unauthorized commands from being transmitted from a user the web application trusts. An attacker on a shared network can identify instances by scanning high-range ports and sending an unauthenticated request to the Clipper handshake endpoint, which returns the application name and protocol version. This can lead to unauthorized data access, phishing, and local system compromise.

Recommendations Update to version 0.102.2.

Exploit

Fix

Missing Authentication

Improper Access Control

Weakness Enumeration

CWE-306

CWE-284

Related Identifiers

CVE-2026-39310

Affected Products

Trilium Notes

References · 4

• 🔥 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39310 · Security Note
• https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 · Note
• https://t.me/CVEtracker/54416 · Telegram Post