Is CVE-2026-44523 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44523 being exploited in the wild.

How severe is CVE-2026-44523?

Critical severity, with a CVSS score of 10, published 14 May 2026.

Which products and versions are affected?

Enchant97 Note Mark <= 0.19.3; Enchant97 Note-Mark Backend < 0.0.0-20260501152247-18b587758667; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152247-18b587758667, SEMVER:introduced=0,fixed=0.0.0-20260501152247-18b587758667.

Is there a fix for CVE-2026-44523?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152247-18b587758667 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44523 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44523?

Check whether you run Enchant97 Note Mark, Enchant97 Note-Mark Backend or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44523: enchant97 Note Mark weak JWT secret allows account takeover

Q: Which products and versions are affected?

Enchant97 Note Mark <= 0.19.3; Enchant97 Note-Mark Backend < 0.0.0-20260501152247-18b587758667; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152247-18b587758667, SEMVER:introduced=0,fixed=0.0.0-20260501152247-18b587758667.

Q: Is there a fix for CVE-2026-44523?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152247-18b587758667 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44523 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44523?

Check whether you run Enchant97 Note Mark, Enchant97 Note-Mark Backend or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44523 · Severity: critical · CVSS 10 · Published 2026-05-14

Note Mark, a self-hosted note-taking application, contains a security flaw in how it handles authentication tokens. The system allows administrators to use extremely short or weak security keys, which can be easily guessed by automated tools. If an attacker successfully guesses this key, they can create fake login credentials to take over any user account, including administrator accounts, gaining full access to all stored notes and system settings.

Technologies: Enchant97 Note Mark, github.com/enchant97/note-mark/backend (Go). Vendors: Enchant97, Go.

Quick answers

Is CVE-2026-44523 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44523 being exploited in the wild.
How severe is CVE-2026-44523?: Critical severity, with a CVSS score of 10, published 14 May 2026.
Which products and versions are affected?: Enchant97 Note Mark <= 0.19.3; Enchant97 Note-Mark Backend < 0.0.0-20260501152247-18b587758667; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152247-18b587758667, SEMVER:introduced=0,fixed=0.0.0-20260501152247-18b587758667.
Is there a fix for CVE-2026-44523?: Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152247-18b587758667 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44523 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44523?: Check whether you run Enchant97 Note Mark, Enchant97 Note-Mark Backend or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152247-18b587758667 or later
```
go get github.com/enchant97/note-mark/backend@v0.0.0-20260501152247-18b587758667
```

Technical details

The Note Mark backend fails to enforce minimum length or entropy requirements for the JWT_SECRET configuration value in 'backend/config/utils.go'. While RFC 7518 requires HS256 keys to be at least 256 bits (32 bytes), the application accepts secrets as short as 1 byte. An attacker can capture a valid JWT from network traffic or cookies and perform an offline brute-force or dictionary attack to recover the weak secret. Once recovered, the attacker can forge JWTs for any user ID, including administrators, bypassing authentication entirely. The vulnerability is addressed in version 0.0.0-20260501152247-18b587758667 (v0.19.4).

Affected products

enchant97 note-mark/backend < 0.0.0-20260501152247-18b587758667

Identifiers

CVE-2026-44523
GHSA-q6mh-rqwh-g786
GO-2026-5567

Timeline

2026-05-02: disclosed: Vulnerability disclosed in enchant97/note-mark repository.
2026-05-07: advisory: GitHub Advisory GHSA-q6mh-rqwh-g786 published.
2026-05-14: patched: CVE-2026-44523 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.