Trilium Notes Authentication Bypass (CVE-2026-39310) Exposes Data

The National Vulnerability Database reports a critical authentication bypass vulnerability, CVE-2026-39310, affecting Trilium Notes versions 0.102.1 and prior. Specifically, the Clipper API in Trilium Desktop (v0.101.3), when running in an Electron environment, explicitly disables authentication middleware. This exposes sensitive endpoints, such as /api/clipper/notes, without requiring a password, API token, or CSRF protection.

This flaw allows an attacker on a shared network—think corporate LANs or public Wi-Fi—to scan for open high-range ports, often used by Trilium (e.g., 37840). An unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a vulnerable Trilium instance. This directly facilitates unauthorized data access, opens avenues for phishing attacks, and can lead to local system compromise. The National Vulnerability Database assigns this a CVSS score of 8.6 (HIGH).

Trilium Notes has addressed this issue in version 0.102.2. Defenders must prioritize patching to mitigate this significant risk. The attacker’s calculus here is straightforward: exploit an explicit design flaw that removes security controls in a specific environment, turning a local network into an open door for data exfiltration and further compromise.