CVE-2026-41572Note Mark: Unauthenticated read of notes and assets in soft-deleted public books
Updated under an hour ago ()
Does this affect you?
It affects enchant97 note-mark. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries. This issue has been patched in version 0.19.3.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-285
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- May 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
enchant97 note-mark enchant97:note_mark (from the name) | before 0.19.3 | CNA record |
References
- https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xfx-refsource-confirm
- https://github.com/enchant97/note-mark/releases/tag/v0.19.3x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.