CVE-2026-50554 - Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Back Back to CVE browser

MEDIUM

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Published Sep 3, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.42%

Description

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

Affected products

Vendor Enchant97 Product Note-Mark Default
n/a
- Version
  < 0.19.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Enchant97

Note-Mark

n/a

Version	Status	Constraints
< 0.19.5	affected	-

github.com/enchant97/note-mark/backend

Go

Introduced 0 Fixed 0.0.0-20260601210758-9c9b72740f22

Ecosystem	Package	Introduced	Fixed
Go	github.com/enchant97/note-mark/backend	0	0.0.0-20260601210758-9c9b72740f22

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-285

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70529
Advisory
https://github.com/advisories/GHSA-588f-fvcv-xhvf
Advisory
https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6
x_refsource_MISC
https://github.com/enchant97/note-mark/releases/tag/v0.19.5
x_refsource_MISC
https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70529		Advisory
https://github.com/advisories/GHSA-588f-fvcv-xhvf		Advisory
https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6		x_refsource_MISC
https://github.com/enchant97/note-mark/releases/tag/v0.19.5		x_refsource_MISC
https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf		exploitx_refsource_CONFIRM