CVE-2026-39310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39310", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T19:31:07.265Z", "datePublished": "2026-05-20T19:05:41.692Z", "dateUpdated": "2026-05-21T12:53:53.647Z"}, "containers": {"cna": {"title": "Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw"}, {"name": "https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2"}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"version": "< 0.102.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-20T19:05:41.692Z"}, "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electron environment. When Trilium detects an Electron environment, it explicitly disables authentication middleware for the Clipper API, exposing endpoints such as /api/clipper/notes to the network with no password, API token, or CSRF protection. An attacker on a shared network (for example, a corporate LAN or public Wi-Fi) can scan for open high-range ports using a tool like nmap, since Trilium often binds to ports such as 37840. Once a candidate port is found, an unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a Trilium instance by returning the application name and protocol version. This facilitates unauthorized data access, phishing, and local system compromise. The issue has been fixed in version 0.102.2."}], "source": {"advisory": "GHSA-jcvx-vc83-cppw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T12:51:29.010426Z", "id": "CVE-2026-39310", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:53:53.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39310", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T12:51:29.010426Z"}}}], "references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:51:24.033Z"}}], "cna": {"title": "Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds", "source": {"advisory": "GHSA-jcvx-vc83-cppw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"status": "affected", "version": "< 0.102.2"}]}], "references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw", "name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2", "name": "https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electron environment. When Trilium detects an Electron environment, it explicitly disables authentication middleware for the Clipper API, exposing endpoints such as /api/clipper/notes to the network with no password, API token, or CSRF protection. An attacker on a shared network (for example, a corporate LAN or public Wi-Fi) can scan for open high-range ports using a tool like nmap, since Trilium often binds to ports such as 37840. Once a candidate port is found, an unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a Trilium instance by returning the application name and protocol version. This facilitates unauthorized data access, phishing, and local system compromise. The issue has been fixed in version 0.102.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-20T19:05:41.692Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39310", "state": "PUBLISHED", "dateUpdated": "2026-05-21T12:53:53.647Z", "dateReserved": "2026-04-06T19:31:07.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-20T19:05:41.692Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Trilium", "vendor": "TriliumNext", "versions": [{"status": "affected", "version": "< 0.102.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electron environment. When Trilium detects an Electron environment, it explicitly disables authentication middleware for the Clipper API, exposing endpoints such as /api/clipper/notes to the network with no password, API token, or CSRF protection. An attacker on a shared network (for example, a corporate LAN or public Wi-Fi) can scan for open high-range ports using a tool like nmap, since Trilium often binds to ports such as 37840. Once a candidate port is found, an unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a Trilium instance by returning the application name and protocol version. This facilitates unauthorized data access, phishing, and local system compromise. The issue has been fixed in version 0.102.2."}, {"lang": "es", "value": "Trilium Notes es una aplicaci\u00f3n de toma de notas jer\u00e1rquica y multiplataforma centrada en la construcci\u00f3n de grandes bases de conocimiento personales. En las versiones 0.102.1 y anteriores, la API Clipper en Trilium Desktop (v0.101.3) permite una omisi\u00f3n completa de la autenticaci\u00f3n cuando se ejecuta en un entorno Electron. Cuando Trilium detecta un entorno Electron, deshabilita expl\u00edcitamente el middleware de autenticaci\u00f3n para la API Clipper, exponiendo puntos finales como /api/clipper/notes a la red sin contrase\u00f1a, token de API o protecci\u00f3n CSRF. Un atacante en una red compartida (por ejemplo, una LAN corporativa o Wi-Fi p\u00fablica) puede escanear en busca de puertos abiertos de alto rango utilizando una herramienta como nmap, ya que Trilium a menudo se enlaza a puertos como el 37840. Una vez que se encuentra un puerto candidato, una solicitud no autenticada al punto final de handshake de Clipper, que tambi\u00e9n omite la autenticaci\u00f3n, confirma una instancia de Trilium al devolver el nombre de la aplicaci\u00f3n y la versi\u00f3n del protocolo. Esto facilita el acceso no autorizado a datos, el phishing y el compromiso del sistema local. El problema ha sido solucionado en la versi\u00f3n 0.102.2."}], "id": "CVE-2026-39310", "lastModified": "2026-07-23T12:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39310", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-21T12:51:29.010426Z", "version": "2.0.3"}}]}, "published": "2026-05-20T20:16:39.213", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.102.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Trilium", "source": "cna", "vendor": "TriliumNext"}, "product": "trilium", "vendor": "triliumnext"}], "created": "2026-05-20T20:30:38.799347+00:00", "updated": "2026-05-20T20:45:03.246007+00:00", "vendors": ["triliumnext", "triliumnext$PRODUCT$trilium"]}