Joplin, an open source note-taking application, has a vulnerability (CVE-2026-34600) in versions prior to 3.5.3 where the delta API improperly preserves permissions. When DELTA_INCLUDES_ITEMS is enabled, the API attaches the latest state of items without verifying if the requesting user still has access. The removal logic only filters items deleted for all users, not those unshared from specific users. Additionally, the change compression logic incorrectly reduces create-delete sequences to no-ops per page, which can drop deletions if create and delete events occur on different pages. This results in the delta API returning create events with full content for notes that should no longer be accessible to the user. The issue is addressed in version 3.5.3.

An unauthorized user who previously had access to shared notes may continue to receive full content of notes that have been unshared, violating confidentiality. The vulnerability does not affect integrity or availability. There are no known exploits in the wild.

This vulnerability is fixed in Joplin version 3.5.3. Users should upgrade to version 3.5.3 or later to remediate this issue. Patch status is confirmed by the vendor's release notes indicating the fix in 3.5.3. No additional mitigation steps are indicated.