CVE-2025-27134: Privilege escalation in Joplin server via user patch endpoint
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27134?
CVE-2025-27134 has a high severity rating due to its potential for privilege escalation in the Joplin server.
How do I fix CVE-2025-27134?
To mitigate CVE-2025-27134, upgrade the Joplin Server to version 3.3.3 or later.
Who is affected by CVE-2025-27134?
CVE-2025-27134 affects users of Joplin Server versions prior to 3.3.3.
What kind of vulnerability is CVE-2025-27134?
CVE-2025-27134 is classified as a privilege escalation vulnerability.
What can happen if CVE-2025-27134 is exploited?
If exploited, CVE-2025-27134 allows non-admin users to gain unauthorized access through the API.