CVE-2026-50554: Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint t

Executive brief

Note Mark is a self-hosted note-taking application. A security flaw allows unauthorized users to view the titles and metadata of notes that a user has deleted (moved to the trash) if those notes were part of a public notebook. While the actual content of the notes remains hidden, the exposure of titles and timestamps could reveal sensitive information or private activities that the user intended to remove from public view.

Technical details

An authorization bypass exists in the `GetNotesByBookID` function within `backend/services/notes.go`. When the `deleted=true` query parameter is provided to the `/api/books/{bookID}/notes` endpoint, the application uses GORM's `Unscoped()` method to include soft-deleted records. However, the authorization logic incorrectly continues to honor the `is_public = true` flag for these 'trashed' items. An unauthenticated attacker can enumerate the metadata (ID, title, slug, and timestamps) of deleted notes belonging to any public book. The note body itself is not exposed as the content retrieval endpoint does not use unscoped queries. A fix is available in version 0.0.0-20260601210758-9c9b72740f22.

Affected products

• enchant97 note-mark < 0.0.0-20260601210758-9c9b72740f22

Timeline

• 2026-06-01: patched: Fix committed to repository
• 2026-07-09: advisory: GitHub Advisory published

References

• https://api.github.com/users/Yunkaiwjs
• https://github.com/Yunkaiwjs
• https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D
• https://api.github.com/users/Yunkaiwjs/repos
• https://avatars.githubusercontent.com/u/235860593?v=4
• https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D