CVE-2026-55210 is an authentication bypass vulnerability in Joplin Server's UserModel.ssoLogin() prior to version 3.7.2. The function returns an existing account matched by an IdP-asserted email without verifying the is_external flag, which distinguishes local from external accounts. In environments using both local and SAML authentication, an attacker who can assert a local user's email via the IdP can submit a POST request to /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without the local password. This vulnerability is addressed in Joplin Server version 3.7.2.

An attacker with a valid IdP session can bypass local authentication controls and gain unauthorized access to a victim's local account on Joplin Server. This includes the ability to view and modify sensitive notes, files, and user settings. The vulnerability compromises confidentiality and integrity of user data but does not affect availability.

Upgrade Joplin Server to version 3.7.2 or later, where this authentication bypass vulnerability is fixed. No other mitigations are indicated by the vendor advisory.