The flaw is in the Joplin Server’s user authentication logic. UserModel.ssoLogin() accepts an IdP‑asserted email and returns the matching local account without verifying the account’s is_external flag. This omission allows an attacker who can generate a SAML assertion for a victim’s email address to obtain a valid session for the local account without knowledge of the user's password. As a result, the attacker can read, modify, or delete the victim’s notes, files, and settings.

This issue affects all Joplin Server installations that use mixed local and SAML authentication and run a version earlier than 3.7.2. The affected vendor is laurent22 under the product name Joplin. Users who have not applied the 3.7.2 release are at risk.

The vulnerability carries a CVSS score of 7.4, indicating high severity. While the EPSS score is unavailable and the flaw is not included in CISA’s KEV list, the attack requires only a legitimate IdP session capable of asserting a local user’s email. Once the attacker supplies a crafted POST /api/saml request, the server will silently create an authenticated session, enabling unrestricted access to the victim’s data. The lack of a defensive check makes exploitation straightforward for someone who can control or predict IdP assertions.