Joplin Server Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in Joplin Server versions prior to 3.3.3. This vulnerability allows non-admin users to exploit the API endpoint 'PATCH /api/users/:id' to elevate their privileges by setting the 'is_admin' field to 1. As a result, low-privileged users can perform administrative actions without proper authorization.

Impact

Exploitation of this vulnerability allows low-privileged users to gain administrative rights and perform actions reserved for administrators.

Reproduction

To reproduce this vulnerability, log in as a non-admin user and send a PATCH request to the '/api/users/:id' endpoint, including a payload that sets the 'is_admin' field to 1. After the request is processed, the user will have administrative privileges.

Remediation

Users can update to Joplin Server version 3.3.3 or later to address this vulnerability.