Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-34600
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-19 May, 2026 | 22:28
Updated At-19 May, 2026 | 22:28
Rejected At-
▼CVE Numbering Authority (CNA)
Joplin Server delta API returns note content after share access is revoked

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289. In ChangeModel.delta, when DELTA_INCLUDES_ITEMS is enabled (the default), the latest state of items is attached to delta output without verifying that those items are still shared with the requesting user, and the existing removal logic only filters items deleted for all users. Additionally, the change compression logic incorrectly reduces create - delete to NOOP, which is unsafe because compression is applied per page and an item can have multiple create events; if an earlier create falls on a separate page from a later create -> delete pair, the deletion is dropped and the sequence collapses to a create. As a result, the delta API returns a create event for a deleted item with the full latest content attached, exposing notes the user no longer has access to. This issue has been fixed in version 3.5.3.

Affected Products
Vendor
laurent22
Product
joplin
Versions
Affected
  • < 3.5.3
Problem Types
TypeCWE IDDescription
CWECWE-281CWE-281: Improper Preservation of Permissions
CWECWE-863CWE-863: Incorrect Authorization
CWECWE-200CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Type: CWE
CWE ID: CWE-281
Description: CWE-281: Improper Preservation of Permissions
Type: CWE
CWE ID: CWE-863
Description: CWE-863: Incorrect Authorization
Type: CWE
CWE ID: CWE-200
Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Metrics
VersionBase scoreBase severityVector
3.15.7MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Version: 3.1
Base score: 5.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94
x_refsource_CONFIRM
https://github.com/laurent22/joplin/issues/14110
x_refsource_MISC
https://github.com/laurent22/joplin/pull/14289
x_refsource_MISC
Hyperlink: https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/laurent22/joplin/issues/14110
Resource:
x_refsource_MISC
Hyperlink: https://github.com/laurent22/joplin/pull/14289
Resource:
x_refsource_MISC
Details not found