The vulnerability allows an attacker, who has obtained a CSRF or account‑confirmation token via a separate breach, to submit that token to the public password‑reset endpoint of Joplin Server. Because the server’s token model stores many token types without distinguishing their purpose, the password‑reset function accepts any token that can be mapped to a user. The attacker can therefore replace the victim’s password, delete all existing sessions, and revoke all associated API applications. This effectively removes the victim’s access and disrupts all authenticated API activity.

The issue affects Joplin Server deployments running any version prior to 3.7.2, distributed by laurent22. Users operating Joplin Server should verify whether their instance version is earlier than 3.7.2 and take corrective action.

The CVSS score of 4.8 indicates a moderate severity. No EPSS score was reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first obtain a CSRF or confirmation token through another disclosure channel. Once a valid token is in hand, the attacker can trivially reset the password through the public endpoint, making the attack feasible but dependent on prior token compromise.