CVE-2026-49450

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

• CWE-345
• CWE-353
• CWE-494

• https://github.com/laurent22/joplin/commit/853659edf575c4f526c2b196e0629462aee9df28
• https://github.com/laurent22/joplin/pull/15539
• https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273
• https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49445Cilium is a networking, observability, and security solution…8.8
• CVE-2026-49446Cosmos provides users the ability self-host a home server by…6.1
• CVE-2026-49447Cosmos provides users the ability self-host a home server by…5.3
• CVE-2026-49448authentik is an open-source identity provider. Prior to vers…9.8
• CVE-2026-49449Joplin is an open source note-taking and to-do application t…2.5
• CVE-2026-4945The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenb…5.3
• CVE-2026-49451The OpenAPI.NET SDK contains a useful object model for OpenA…7.5
• CVE-2026-49452WeasyPrint helps web developers to create PDF documents. Pri…6.5
• CVE-2026-49453Joplin is an open source note-taking and to-do application t…7
• CVE-2026-49454Relyra is a strict-by-default SAML 2.0 Service Provider libr…9.1
• CVE-2026-49455Waku is the minimal React framework. Prior to version 1.0.0-…6.5
• CVE-2026-49456Waku is the minimal React framework. Prior to version 1.0.0-…3.1