CVE-2026-50554
Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.
How to fix
- github.com/enchant97/note-mark/backend0.0.0-20260601210758-9c9b72740f22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/enchant97/note-mark/backendGo | v < 0.0.0-20260601210758-9c9b72740f22 | 0.0.0-20260601210758-9c9b72740f22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.