Read the docs
TI-2026-30127 Aliases CVE-2026-41572GHSA-3gr9-485j-v4xf

Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

Priority MEDIUM 63CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries. This issue has been patched in version 0.19.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed note-mark (enchant97): 0.19.3github.com/enchant97/note-mark/backend (Go): 0.0.0-20260417132843-d1bf845a2a2d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-markbefore 0.19.30.19.3Patch availableCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260417132843-d1bf845a2a2d0.0.0-20260417132843-d1bf845a2a2dPatch availableGHSA-3gr9-485j-v4xf
  • note-mark Vendorenchant97 Affected before 0.19.3 Fixed in 0.19.3 Patch available CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260417132843-d1bf845a2a2d Fixed in 0.0.0-20260417132843-d1bf845a2a2d Patch available GHSA-3gr9-485j-v4xf

Remediation

  • Fix · CNA note-mark (enchant97) Fixed in 0.19.3
  • Fix · GHSA-3gr9-485j-v4xf github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260417132843-d1bf845a2a2d Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41572
  2. 2026-10-03 Alias added: GHSA-3gr9-485j-v4xf

References

Advisory 1

Other 4

  • TI-2026-32452 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVSS 3.1CRITICAL 10.0
  • TI-2026-30126 Note Mark: OIDC-registered users authenticated by submitting password "null" CVSS 3.1CRITICAL 9.4
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-37275 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVSS 4.0HIGH 8.6
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-37276 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences