CVE-2026-41572 Details
Description
Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries. This issue has been patched in version 0.19.3.
A vulnerability in Note Mark, an open-source note-taking application, allows unauthenticated users to access notes and assets from soft-deleted public books. This issue affects versions through 0.19.2. The vulnerability arises because the soft-delete function does not properly filter raw SQL joins used in note and asset queries, leaving content accessible via specific API endpoints.
Users can update to Note Mark version 0.19.3, which addresses this vulnerability by ensuring that soft-deleted books are properly filtered out in the visibility checks for notes and assets.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/enchant97/note-mark/releases/tag/v0.19.3 | [email protected] | Release NotesVendor |
| https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| enchant97/note-mark | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |