CyberRota Analysis
AI-GeneratedJoplin Server versions prior to 3.7.2 are vulnerable due to a flaw in the UserModel.ssoLogin() function, which allows an attacker to exploit mixed local and SAML authentication setups. By leveraging an IdP session that asserts a local user's email, the attacker can gain unauthorized access to the victim's notes, files, and settings without needing the local password. Organizations using Joplin Server with SAML authentication should prioritize upgrading to version 3.7.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.