CVE-2026-39310 describes an improper access control vulnerability (CWE-284) in Trilium Notes (versions prior to 0.102.2). When running in an Electron environment, the Clipper API disables authentication middleware, exposing endpoints such as /api/clipper/notes without any authentication or CSRF protections. Attackers on shared networks can scan for open high-range ports (e.g., 37840) to identify Trilium instances and access sensitive functionality unauthenticated. The vulnerability allows unauthorized data access and could facilitate phishing or local system compromise. This vulnerability has a CVSS v3.1 score of 8.6 (high severity) and was fixed in version 0.102.2.

An attacker on a shared network can bypass authentication entirely to access the Clipper API endpoints of Trilium Notes instances running in Electron environments. This unauthorized access can lead to data exposure, phishing attacks, and potential compromise of the local system. The vulnerability affects confidentiality, integrity, and availability to varying degrees as indicated by the CVSS vector (C:L/I:H/A:L).

Upgrade Trilium Notes to version 0.102.2 or later, where this vulnerability is fixed. Versions prior to 0.102.2 disable authentication middleware in Electron environments, exposing the Clipper API. No other official remediation or temporary fix is documented. Until upgrading, restrict network access to Trilium instances to trusted networks only to reduce exposure.