# CVE-2026-50554: Note Mark information disclosure of soft-deleted notes in public books

Source: https://junglewise.ai/threats/cve-2026-50554-note-mark-information-disclosure-of-soft-deleted-notes-in-public  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-50554 · Severity: medium · CVSS 5.3 · Published 2026-09-03

Note Mark is a self-hosted note-taking application. A security flaw allows unauthorized users to view the titles and metadata of notes that a user has deleted (moved to the trash) if those notes were part of a public notebook. While the actual content of the notes remains hidden, the exposure of titles and timestamps could reveal sensitive information or private activities that the user intended to remove from public view.

Technologies: [Enchant97 Note Mark](https://junglewise.ai/threats/technologies/note-mark), [github.com/enchant97/note-mark/backend (Go)](https://junglewise.ai/threats/technologies/github-com-enchant97-note-mark-backend). Vendors: [Enchant97](https://junglewise.ai/threats/vendors/enchant97), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-50554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50554 being exploited in the wild.

**How severe is CVE-2026-50554?** Medium severity, with a CVSS score of 5.3, published 3 September 2026.

**Which products and versions are affected?** Enchant97 Note Mark < 0.0.0-20260601210758-9c9b72740f22; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210758-9c9b72740f22, SEMVER:introduced=0,fixed=0.0.0-20260601210758-9c9b72740f22.

**Is there a fix for CVE-2026-50554?** Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50554 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50554?** Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210758-9c9b72740f22 or later

  ```sh
  go get github.com/enchant97/note-mark/backend@v0.0.0-20260601210758-9c9b72740f22
  ```


## Technical details

An authorization bypass exists in the `GetNotesByBookID` function within `backend/services/notes.go`. When the `deleted=true` query parameter is provided to the `/api/books/{bookID}/notes` endpoint, the application uses GORM's `Unscoped()` method to include soft-deleted records. However, the authorization logic incorrectly continues to honor the `is_public = true` flag for these 'trashed' items. An unauthenticated attacker can enumerate the metadata (ID, title, slug, and timestamps) of deleted notes belonging to any public book. The note body itself is not exposed as the content retrieval endpoint does not use unscoped queries. A fix is available in version 0.0.0-20260601210758-9c9b72740f22.

## Affected products

- enchant97 note-mark < 0.0.0-20260601210758-9c9b72740f22

## Identifiers

- CVE-2026-50554
- GHSA-588f-fvcv-xhvf
- GO-2026-5948

## Timeline

- 2026-06-01: patched: Fix committed to repository
- 2026-07-09: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Yunkaiwjs](https://api.github.com/users/Yunkaiwjs)
- [https://github.com/Yunkaiwjs](https://github.com/Yunkaiwjs)
- [https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D](https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D)
- [https://api.github.com/users/Yunkaiwjs/repos](https://api.github.com/users/Yunkaiwjs/repos)
- [https://avatars.githubusercontent.com/u/235860593?v=4](https://avatars.githubusercontent.com/u/235860593?v=4)
- [https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D](https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D)

## Related threats

- [Note Mark path traversal in migrate export via unsanitized slugs](https://junglewise.ai/threats/cve-2026-50553-note-mark-path-traversal-in-migrate-export-via-unsanitized-slugs)
- [enchant97 Note Mark weak JWT secret allows account takeover](https://junglewise.ai/threats/cve-2026-44523-enchant97-note-mark-weak-jwt-secret-allows-account-takeover)
- [enchant97 Note Mark path traversal in asset upload](https://junglewise.ai/threats/cve-2026-44522-enchant97-note-mark-path-traversal-in-asset-upload)
- [Note Mark: Unauthenticated read of notes and assets in soft-deleted public books](https://junglewise.ai/threats/cve-2026-41572-note-mark-unauthenticated-read-of-notes-and-assets-in-soft)
- [Note Mark: OIDC-registered users authenticated by submitting password "null"](https://junglewise.ai/threats/cve-2026-41571-note-mark-oidc-registered-users-authenticated-by-submitting)