CVE-2026-59815

Joplin Server (an open-source note-taking and to-do application) had an authorization flaw in ItemModel.checkIfAllowed() prior to version 3.7.7 . The method granted write access to items with a share ID whenever any share_users row existed for the caller, without requiring ShareUserStatus.Accepte...

CVE-2026-59815: Incorrect Authorization

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...