CVE-2026-50554
MediumCVSS 5.3Summary
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view.
Risk Assessment
The vulnerability allows unauthorized users to access metadata of deleted notes, potentially violating user privacy and exposing information that was intended to be hidden.
Recommendation
Update Note Mark to version 0.19.5 or later. Additionally, consider restricting access to the endpoint and implementing authorization mechanisms for queries about deleted notes.
Other vulnerabilities in Note Mark
See all- CVE-2026-50553High
Note Mark prior to version 0.19.5 improperly validates slug values because the OpenAPI/huma pattern is not anchored, allowing paths with ../ segments to be accepted. Data export commands use these slugs to create files outside the export directory, potentially leading to file writes with root privileges.
- CVE-2026-44523Critical
The Note Mark application prior to version 0.19.4 does not enforce minimum length or entropy for the JWT_SECRET configuration value. It allows any base64-decodable secret, including secrets as short as 1 byte.
Original NVD description (English source)
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.