Joplin Desktop for Windows prior to version 3.7.2 generates an updater configuration file that omits the publisherName field. This omission causes the NsisUpdater.verifySignature() routine to skip verifying that a downloaded update is signed by the expected publisher. An attacker who can alter the update delivery path can replace both the update metadata and the installer. When the client accepts the installer, the malicious code runs with the user's local privileges, giving the attacker full access to notes, credentials, and other data. The weakness corresponds to missing authentication and authorization checks (CWE-345), missing integrity checks (CWE-353), and improper handling of trusted data (CWE-494).

Based on the description, it is inferred that the vulnerability affects Joplin Desktop for Windows versions 3.7.1 and earlier, as the issue was fixed in 3.7.2. The affected product is Joplin Desktop for Windows, developed by Laurent22.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control the update server or intercept network traffic to supply a malicious update. Once the malicious installer is installed, it executes with the user's privileges, granting full local access.