CVE-2025-27134

Katalog CVE

CVSS 8.8 · High EPSS 2,2%

Kerentanan Improper Access Control pada joplin project joplin. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.

Rincian

Terbit di NVD

30 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x exploit · advisory vendor
• https://github.com/laurent22/joplin/commit/12baa9827dac9da903f244c9f358e3deb264e228 patch