Is CVE-2026-50554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50554 being exploited in the wild.

How severe is CVE-2026-50554?

Medium severity, with a CVSS score of 5.3, published 3 September 2026.

Which products and versions are affected?

Enchant97 Note Mark < 0.0.0-20260601210758-9c9b72740f22; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210758-9c9b72740f22, SEMVER:introduced=0,fixed=0.0.0-20260601210758-9c9b72740f22.

Is there a fix for CVE-2026-50554?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50554 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50554?

Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50554: Note Mark information disclosure of soft-deleted notes in public books

Q: Which products and versions are affected?

Enchant97 Note Mark < 0.0.0-20260601210758-9c9b72740f22; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210758-9c9b72740f22, SEMVER:introduced=0,fixed=0.0.0-20260601210758-9c9b72740f22.

Q: Is there a fix for CVE-2026-50554?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50554 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50554?

Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50554 · Severity: medium · CVSS 5.3 · Published 2026-09-03

Note Mark is a self-hosted note-taking application. A security flaw allows unauthorized users to view the titles and metadata of notes that a user has deleted (moved to the trash) if those notes were part of a public notebook. While the actual content of the notes remains hidden, the exposure of titles and timestamps could reveal sensitive information or private activities that the user intended to remove from public view.

Technologies: Enchant97 Note Mark, github.com/enchant97/note-mark/backend (Go). Vendors: Enchant97, Go.

Quick answers

Is CVE-2026-50554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50554 being exploited in the wild.
How severe is CVE-2026-50554?: Medium severity, with a CVSS score of 5.3, published 3 September 2026.
Which products and versions are affected?: Enchant97 Note Mark < 0.0.0-20260601210758-9c9b72740f22; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210758-9c9b72740f22, SEMVER:introduced=0,fixed=0.0.0-20260601210758-9c9b72740f22.
Is there a fix for CVE-2026-50554?: Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50554 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50554?: Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later
```
go get github.com/enchant97/note-mark/backend@v0.0.0-20260601210758-9c9b72740f22
```

Technical details

An authorization bypass exists in the `GetNotesByBookID` function within `backend/services/notes.go`. When the `deleted=true` query parameter is provided to the `/api/books/{bookID}/notes` endpoint, the application uses GORM's `Unscoped()` method to include soft-deleted records. However, the authorization logic incorrectly continues to honor the `is_public = true` flag for these 'trashed' items. An unauthenticated attacker can enumerate the metadata (ID, title, slug, and timestamps) of deleted notes belonging to any public book. The note body itself is not exposed as the content retrieval endpoint does not use unscoped queries. A fix is available in version 0.0.0-20260601210758-9c9b72740f22.

Affected products

enchant97 note-mark < 0.0.0-20260601210758-9c9b72740f22

Identifiers

CVE-2026-50554
GHSA-588f-fvcv-xhvf
GO-2026-5948

Timeline

2026-06-01: patched: Fix committed to repository
2026-07-09: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.