https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:31:11 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55210 <p><strong>Affected:</strong> laurent22 joplin</p> <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server&#39;s UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account&#39;s is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user&#39;s email can pass POST /api/saml, receive a session for that local account, and access or modify the victim&#39;s notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.</p> <p><strong>Affected:</strong> laurent22 joplin</p> <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server&#39;s UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account&#39;s is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user&#39;s email can pass POST /api/saml, receive a session for that local account, and access or modify the victim&#39;s notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-55210