The vulnerability occurs in the Joplin Desktop Web Clipper server, which prior to version 3.7.13 responds to authentication requests with an Access‑Control‑Allow‑Origin header set to a wildcard ("*"). As a result, any website can send POST requests to the pairing endpoint ("/auth") and confirm the pairing with GET requests to "/auth/check". The server does not verify the origin of the request, and the desktop confirmation dialog does not reveal that origin to the user. As a consequence, when a user approves the generic pairing prompt, an attacker’s page can capture the permanently generated API token, which provides persistent read and write privileges to the user's notes, folders, tags, resources, and master keys. This leads to complete confidentiality, integrity, and availability compromise of all user data in the application.

This issue affects the open‑source Joplin note‑taking application developed by laurent22. The desktop client (Windows, macOS, Linux) is vulnerable in all releases prior to version 3.7.13 that enable the optional Web Clipper server. Users running earlier versions with the Web Clipper feature enabled are susceptible to this flaw.

With a CVSS score of 8.0, the flaw presents a high-level risk. The EPSS score is currently unavailable, indicating that measurable exploit probability data is not available, but the absence of a KEV listing does not diminish the intrinsic severity of the exposure. An attacker can trigger exploitation simply by having the victim run Joplin Desktop with the Web Clipper server enabled and interact with a malicious web page that initiates the pairing request; the user’s acceptance of the generic prompt automatically legitimises the rogue site. Because the pairing process creates a permanent token, the attacker obtains long‑term access without needing to re‑authenticate, magnifying the potential impact.