Read the docs
TI-2026-37276 Aliases CVE-2026-50554GHSA-588f-fvcv-xhvf

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Priority MEDIUM 63CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-285.

Summary

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed note-mark (enchant97): 0.19.5github.com/enchant97/note-mark/backend (Go): 0.0.0-20260601210758-9c9b72740f22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-markbefore 0.19.50.19.5Patch availableCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260601210758-9c9b72740f220.0.0-20260601210758-9c9b72740f22Patch availableGHSA-588f-fvcv-xhvf
  • note-mark Vendorenchant97 Affected before 0.19.5 Fixed in 0.19.5 Patch available CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260601210758-9c9b72740f22 Fixed in 0.0.0-20260601210758-9c9b72740f22 Patch available GHSA-588f-fvcv-xhvf

Remediation

  • Fix · CNA note-mark (enchant97) Fixed in 0.19.5
  • Fix · GHSA-588f-fvcv-xhvf github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260601210758-9c9b72740f22 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50554
  2. 2026-10-03 Alias added: GHSA-588f-fvcv-xhvf

References

Other 4

  • TI-2026-32452 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVSS 3.1CRITICAL 10.0
  • TI-2026-30126 Note Mark: OIDC-registered users authenticated by submitting password "null" CVSS 3.1CRITICAL 9.4
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-37275 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVSS 4.0HIGH 8.6
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-30127 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences