CVE-2026-46649

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/laurent22/joplin/commit/fd8c1fb53f98f689e846dc164e39f307f09b684d
https://github.com/laurent22/joplin/pull/15433
https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h
https://github.com/laurent22/joplin/tree/v3.7.2
https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h

Configurations

No configuration.

History

28 Sep 2026, 21:17

Type	Values Removed	Values Added
References	~~() https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h -~~	() https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h -

21 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 21:17

Updated : 2026-09-28 21:17

NVD link : CVE-2026-46649

Mitre link : CVE-2026-46649

CVE.ORG link : CVE-2026-46649

JSON object : View

Products Affected

No product.

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-46649", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46649", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T20:18:43.323006Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "laurent22", "product": "joplin", "versions": [{"status": "affected", "version": "< 3.7.2"}]}]}], "published": "2026-09-21T21:17:03.323", "references": [{"url": "https://github.com/laurent22/joplin/commit/fd8c1fb53f98f689e846dc164e39f307f09b684d", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/pull/15433", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/tree/v3.7.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2."}], "lastModified": "2026-09-28T21:17:17.733", "sourceIdentifier": "security-advisories@github.com"}