Executive brief
Note Mark: Unauthenticated read of notes and assets in soft-deleted public books in github.com/enchant97/note-mark/backend
Affected products
- Go github.com/enchant97/note-mark/backend
Junglewise Threat Intelligence
CVE-2026-41572: GO-2026-5085 - Note Mark: Unauthenticated read of notes and assets in soft-deleted public books in github.com/enchant97/note-mark/backend
CVE-2026-41572 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/enchant97/note-mark/backend (Go). Vendors: Go.
Related threats
- Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI
- Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint t
- GO-2026-5557 - Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend
- enchant97 Note Mark weak JWT secret allows account takeover
- enchant97 Note Mark path traversal in asset upload