A missing authorization check in Joplin Server allows any authenticated user to access notes belonging to other users, potentially leading to unauthorized data disclosure.

This is an authorization bypass vulnerability (CWE-639) occurring in the GET /items/:id/content route. The application fails to verify if the authenticated user has permission to access the requested item ID, allowing users to read sensitive notes that are not protected by end-to-end encryption.

The vulnerability poses a significant risk to data confidentiality for organizations relying on Joplin for internal documentation and knowledge management. By guessing or obtaining valid item IDs, an attacker can exfiltrate sensitive information from other users' notebooks, leading to potential data breaches and privacy violations. While the CVSS score is 6.5, the risk is elevated in environments where sensitive corporate data is stored in unencrypted notes.

Immediate Action: Update Joplin Server to version 3.7.2 or later to apply the necessary authorization checks.

Proactive Monitoring: Review server access logs for anomalous patterns, specifically looking for high volumes of GET requests to the /items/ endpoint from non-administrative user accounts.

Compensating Controls: Ensure all sensitive notes are protected with end-to-end encryption, as the vulnerability does not bypass this layer of security.

Public Exploit Available: Unknown.

Given the potential for unauthorized data access, administrators should prioritize updating to version 3.7.2 immediately. Organizations should also audit their current Joplin configurations to ensure that critical notes are encrypted end-to-end, providing a secondary defense against this class of authorization flaws.