CVE-2026-105785: falha de média gravidade em laurent22 joplin
Joplin Server password reset accepts tokens issued for unrelated purposes
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.2%
probabilidade de exploração
0.2%top 92% das CVEs
exploração observada
nãonenhuma fonte reporta
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
laurent22 · joplinCVEs relacionadas — laurent22 joplin
No mesmo produto, das mais perigosas para as menos.
CVE-2025-27134HIGHPrivilege escalation in Joplin server via user patch endpointEPSS 2.2%CVE-2024-49362HIGHRemote Code Execution on click of <a> Link in markdown previewEPSS 1.0%CVE-2023-45673HIGHArbitrary code execution on click of PDF links in JoplinEPSS 1.0%CVE-2024-40643CRITICALJoplin has a parsing error leading to Cross-site Scripting (XSS)EPSS 0.8%CVE-2024-53268HIGHLack of validation on openExternal allows 1 click remote code execution in joplinEPSS 0.7%CVE-2025-27409HIGHJoplin Server Vulnerable to Path TraversalEPSS 0.6%