The vulnerability is a logic error in Joplin Server’s GET /items/:id/content route that accepts an internal server ID supplied by the user but performs no ownership check before returning the item’s content. Any authenticated user who knows or can guess another user’s ID can retrieve that user’s note data. The flaw leads to confidentiality compromise of unencrypted notes and is classified as CWE‑639, Authorization Bypass Through User‑Controlled Key.

Joplin Server versions earlier than 3.7.2, released by the vendor laurent22, are affected. Users running these older releases on any supported platform should assume that any stored note or to‑do item may be read by other authenticated users when end‑to‑end encryption is not enabled.

The CVSS base score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated to the Joplin Server and possess or guess a valid internal ID, making it an insider or credential‑guessing risk. Though the path is remote—it operates over the network—the attack requires legitimate user credentials and knowledge of an item’s internal ID. Consequently the risk is primarily data exposure for unencrypted notes, with a moderate likelihood under realistic threat scenarios.