- Description
- Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-284
- nvd@nist.gov
- NVD-CWE-noinfo
- Hype score
- Not currently trending
🚨 CVE-2025-27134 - high 🚨 Joplin 3.3.3 Server - Privilege Escalation > Joplin is a free, open source note taking and to-do application, which can handle a l... 👾 https://t.co/bnUpLMWEPS @pdnuclei #NucleiTemplates #cve
@pdnuclei_bot
15 Jun 2025
121 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-27134 🔴 HIGH (8.8) 🏢 laurent22 - joplin 🏗️ < 3.3.3 🔗 https://t.co/eebl0xv2yn 🔗 https://t.co/Bd5bz8BrtU #CyberCron #VulnAlert #InfoSec https://t.co/Qy6aQWImds
@cybercronai
2 May 2025
27 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-27134 Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privileg… https://t.co/mFBbuLL2Kn
@CVEnew
30 Apr 2025
311 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*",
"vulnerable": true,
"matchCriteriaId": "DD591BFD-416F-494A-8CF5-1BE3656CCC27",
"versionEndExcluding": "3.3.3"
}
],
"operator": "OR"
}
]
}
]