Read the docs
TI-2026-30126 Aliases CVE-2026-41571GHSA-pxf8-6wqm-r6hh

Note Mark: OIDC-registered users authenticated by submitting password "null"

Priority HIGH 82CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed github.com/enchant97/note-mark/backend (Go): 0.0.0-20260417132909-dea5530cc989

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-mark= 0.19.2—No fix listedCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260417132909-dea5530cc9890.0.0-20260417132909-dea5530cc989Patch availableGHSA-pxf8-6wqm-r6hh
  • note-mark Vendorenchant97 Affected = 0.19.2 Fixed in — No fix listed CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260417132909-dea5530cc989 Fixed in 0.0.0-20260417132909-dea5530cc989 Patch available GHSA-pxf8-6wqm-r6hh

Remediation

  • Fix · GHSA-pxf8-6wqm-r6hh github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260417132909-dea5530cc989 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41571
  2. 2026-10-03 Alias added: GHSA-pxf8-6wqm-r6hh

References

Advisory 1

Other 4

  • TI-2026-32452 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVSS 3.1CRITICAL 10.0
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-37275 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVSS 4.0HIGH 8.6
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-37276 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVSS 3.1MEDIUM 5.3
  • TI-2026-30127 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences