CVE-2026-50554 Details
Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.
A vulnerability exists in Note Mark, an open-source note-taking application, prior to version 0.19.5. The issue arises in the unauthenticated API endpoint GET /api/books/{bookID}/notes, which accepts a 'deleted' query parameter. When 'deleted' is set to true, the endpoint bypasses GORM's soft-delete mechanism, allowing unauthenticated users to access metadata of soft-deleted notes from any public book. This includes notes that the owner has deleted and expected to be removed from public view. The vulnerability allows enumeration of soft-deleted note metadata, such as titles and timestamps, while the note content remains inaccessible.
Users can update to Note Mark version 0.19.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6 | [email protected] | Source CodeVendor |
| https://github.com/enchant97/note-mark/releases/tag/v0.19.5 | [email protected] | Release NotesVendor |
| https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Enchant97 Note Mark | <= 0.19.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |