An unauthenticated attacker can choose a custom application authorization identifier, have the victim approve it through the normal consent process, then redeem the resulting durable application ID and password to obtain a session token that grants full read‑and‑write access to the victim’s synchronized data. This flaw effectively allows account takeover without any authentication or authorization checks, exposing all notes, to‑do items, and attachments.

The vulnerability affects Joplin installations from all older releases before version 3.7.13, as distributed by the Laurent22 vendor. Users running the open source JavaScript/Node.js server component, which includes the ApplicationModel, routes, and API layers, are exposed. Upgrading to 3.7.13 or later removes the flaw.

The flaw carries a CVSS score of 8.5, indicating high severity, and no EPSS score is available; it is also not listed in the CISA KEV catalog. An attacker only needs to persuade a victim to approve the malicious application identifier—a step that can be facilitated by social engineering or phishing—and then use the public API endpoint to redeem the identifier. Because no authentication is performed during redemption, the attack can succeed without any further credentials, making it highly exploitable in environments where users are encouraged to accept third‑party applications.