CVE-2025-27134 Scanner
CVE-2025-27134 Scanner - Privilege Escalation vulnerability in Joplin
Used 2.4k times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2025-27134
8.8
CVSShigh
Exploitable remotely over the internet · low-privilege account sufficient.
Description
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
Attack Vector
Network
Privileges Req.
Low
User Interaction
None
joplin
Updated Nov 7, 2026View on NVD →
S4E scanner
CVE history: joplin
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →