CVE-2026-50554
Received Received - Intake

Information Disclosure in Note Application

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-50554
EUVD
EUVD-2026-70529

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
enchant97 note-mark to 0.19.5 (exc)
enchant97 note-mark 0.19.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the note-mark application before version 0.19.5. An unauthenticated endpoint GET /api/books/{bookID}/notes accepts a deleted=true query parameter. When used, it bypasses soft-delete protection but still applies read authorization rules. This allows anyone to view metadata of soft-deleted notes in public books, even though the owner intended them to be permanently deleted.

Detection Guidance

To detect this vulnerability, check if your note-mark instance is running a version prior to 0.19.5. Use curl to test the affected endpoint: curl -X GET 'http://<target>/api/books/<bookID>/notes?deleted=true'. If the response includes metadata of soft-deleted notes in public books, the system is vulnerable.

Impact Analysis

An attacker could access metadata of soft-deleted notes in public books without authentication. This exposes note titles, slugs, and timestamps even after deletion. The note content itself remains protected. The impact is limited to metadata exposure with a CVSS score of 5.3 (Medium severity).

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing soft-deleted note metadata without authentication. GDPR requires proper data deletion and protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access to deleted metadata may violate these regulations if such data includes personal or sensitive information.

Mitigation Strategies

Immediately upgrade note-mark to version 0.19.5 or later. If upgrading is not possible, restrict access to the /api/books/{bookID}/notes endpoint or apply a patch to the GetNotesByBookID function to enforce proper authorization checks for soft-deleted notes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart