CVE-2025-27134
Published: 30 April 2025
Summary
CVE-2025-27134 is a high-severity Improper Access Control (CWE-284) vulnerability in Joplin Project Joplin. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Joplin is a free open-source note-taking application whose server component prior to version 3.3.3 contains a privilege-escalation flaw. The issue resides in the PATCH /api/users/:id endpoint, which fails to enforce authorization checks and permits any authenticated user to modify the is_admin field on user objects. The vulnerability is tracked as CVE-2025-27134 and carries a CVSS 3.1 score of 8.8.
An attacker who already possesses a low-privileged account on the Joplin server can send a crafted PATCH request that sets is_admin to 1, thereby gaining administrative rights and the ability to perform any server action without further authorization.
The project has released version 3.3.3 that corrects the missing authorization check. The fix is documented in GitHub Security Advisory GHSA-xj67-649m-3p8x and the corresponding commit 12baa9827dac9da903f244c9f358e3deb264e228; administrators are advised to upgrade immediately.
EPSS for the CVE rose from a low baseline to a peak of 0.1342, indicating that exploitation interest increased after public disclosure. No confirmed in-the-wild exploitation has been reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14844
Vulnerability details
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit…
more
the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
By automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Requiring prior authorization for each remote access type prevents improper access control over remote connections.
Requiring authorization of wireless access before allowing connections enforces proper access control for this access method.