CVE-2026-41572
Note Soft-Delete Bypass in Mark Application
Publication date: 2026-05-04
Last updated on: 2026-05-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| note_mark | note_mark | 0.19.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated access to notes and uploaded assets that were intended to be soft-deleted by the owner of a public book. Because the data remains accessible despite deletion attempts, this could lead to unauthorized disclosure of potentially sensitive information.
Such unauthorized data exposure may conflict with compliance requirements in standards and regulations like GDPR and HIPAA, which mandate proper data deletion and protection of personal or sensitive information.
However, the CVE description does not explicitly mention compliance impacts or specific regulatory considerations.
Can you explain this vulnerability to me?
This vulnerability affects Note Mark, an open-source note-taking application. Before version 0.19.3, when the owner of a public book soft-deletes it, the notes and uploaded assets within that book remain accessible. Specifically, unauthenticated users who know the note ID or the slug URL can still access the notes and assets through various API endpoints and URLs.
The root cause is that the soft-delete mechanism in the database ORM (GORM) does not apply correctly to certain raw SQL queries involving JOINs used to fetch notes and assets, allowing these deleted items to remain readable.
This issue was fixed in version 0.19.3 of Note Mark.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to notes and uploaded assets that the owner intended to delete or hide by soft-deleting a public book. Since unauthenticated users can still access this content if they have the note ID or slug URL, sensitive or private information may be exposed unintentionally.
The impact is limited to information disclosure (confidentiality), as the vulnerability does not affect integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Note Mark to version 0.19.3 or later, where the issue has been patched.