CVE-2026-105786: Joplin is an open source note-taking and to-do

Detection and triage

Use read-only checks to decide whether CVE-2026-105786 reaches an owned asset. Treat advisories and proof-of-concept material as evidence, never as executable instructions.

Read-only exposure checks

• Map every affected endpoint and protocol path, including alternate ports, legacy routes, recovery flows, service accounts, and machine-to-machine access.
• Confirm which deployments enable the affected authentication mode and whether the interface is reachable from untrusted networks.
• Review session, token, credential, and proxy trust configuration without attempting account takeover.
• Map object and action authorization checks across API, UI, batch, import/export, and background-job paths.
• Identify tenant, ownership, role, and policy boundaries for affected resources and administrative operations.
• Use synthetic fixtures to compare intended access matrices without accessing another user's real data.
• Inventory affected algorithms, key uses, trust stores, certificate validation settings, random sources, and plaintext channels across clients and services.
• Determine which secrets, identities, signatures, or data protections depend on the affected primitive or validation path.
• Check debug, compatibility, fallback, and hostname or audience override settings in build and runtime configuration.

Detection signals and verification

• Fail-open behavior during identity-provider, cache, or network failure.
• Alternate protocol handlers, case normalization, duplicate headers, recovery links, and pre-authentication APIs.
• Authentication being present without equivalent authorization for the requested action.
• Bulk endpoints, indirect references, nested objects, exports, search results, and presigned links.
• Policy differences between REST, GraphQL, RPC, WebSocket, and worker paths.
• Cache keys or background jobs that omit principal or tenant context.
• Hostname, audience, chain, revocation, time, and purpose checks that are performed separately or skipped on retries.
• Legacy clients and fallback paths re-enabling weak settings after the primary path is fixed.
• Encrypted data that remains affected until re-encrypted or retired.

Stop and triage

• Stop if any protected path lacks an explicit, testable authentication decision.
• Switch to incident response if unauthorized sessions or unexplained administrative access are identified.
• Do not validate using credentials or accounts not authorized for the test.
• Stop if the fix relies on hidden identifiers, UI controls, or client-side checks.
• Switch to incident response if logs or data indicate unauthorized cross-user, cross-tenant, or administrative access.
• Do not test authorization boundaries with real customer records.
• Stop if remediation would expose private keys, weaken validation, or rotate trust without a coordinated recovery plan.
• Switch to incident response if key compromise, forged identity, downgrade, or unauthorized decryption is suspected.
• Do not invent cryptographic constructions or implement primitives directly.

Triage output: Return a reviewer-ready minimal patch with exposure evidence, authoritative fixed-version evidence, regression tests, deployed-artifact verification, rollback notes, and source links; otherwise return TRIAGE.md with the blocking decision and owner.