Vulnerability Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b0
- https://github.com/enchant97/note-mark/releases/tag/v0.19.5
- https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf
- https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf
FAQ
What is CVE-2026-50554?
CVE-2026-50554 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is...
How severe is CVE-2026-50554?
CVE-2026-50554 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-50554?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.