Vulnerability-Lookup

CVE-2026-50554 (GCVE-0-2026-50554)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:26 – Updated: 2026-09-03 15:56

Title

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Summary

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:56 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/enchant97/note-mark/security/a…	x_refsource_CONFIRM
https://github.com/enchant97/note-mark/commit/9c9…	x_refsource_MISC
https://github.com/enchant97/note-mark/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
enchant97	note-mark	Affected: < 0.19.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50554",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:56:08.738577Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:56:23.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "note-mark",
          "vendor": "enchant97",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a \"deleted\" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM\u0027s soft-delete scope) but keeps the read-authorization clause as \"owner_id = ? OR is_public = ?\". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (\"trashed\") notes belonging to any public book \u2014 notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:26:42.538Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf"
        },
        {
          "name": "https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6"
        },
        {
          "name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.5"
        }
      ],
      "source": {
        "advisory": "GHSA-588f-fvcv-xhvf",
        "discovery": "UNKNOWN"
      },
      "title": "Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50554",
    "datePublished": "2026-09-03T15:26:42.538Z",
    "dateReserved": "2026-06-04T21:34:34.425Z",
    "dateUpdated": "2026-09-03T15:56:23.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-50554",
      "date": "2026-06-14",
      "epss": "0.00048",
      "percentile": "0.15517"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-50554\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-03T16:17:25.020\",\"lastModified\":\"2026-09-03T16:17:25.020\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a \\\"deleted\\\" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM\u0027s soft-delete scope) but keeps the read-authorization clause as \\\"owner_id = ? OR is_public = ?\\\". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (\\\"trashed\\\") notes belonging to any public book \u2014 notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"enchant97\",\"product\":\"note-mark\",\"versions\":[{\"version\":\"\u003c 0.19.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-03T15:56:08.738577Z\",\"id\":\"CVE-2026-50554\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"references\":[{\"url\":\"https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/enchant97/note-mark/releases/tag/v0.19.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}"
  }
}

GHSA-588F-FVCV-XHVF

Vulnerability from github – Published: 2026-07-09 13:41 – Updated: 2026-07-09 13:41

Summary

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

Details

Summary

GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view.

Affected component (code-verified)

backend/services/notes.go — GetNotesByBookID (lines 72-89):

func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) { tx := db.DB if deleted { tx = tx.Unscoped() // <-- bypasses soft-delete scope } tx = tx. Preload("Book"). Joins("JOIN books ON books.id = notes.book_id"). Where( db.DB.Where("books.id = ?", bookID), db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true), // <-- is_public still honored for trash ) if deleted { tx = tx.Where("notes.deleted_at IS NOT NULL") } var notes []db.Note return notes, dbErrorToServiceError(tx.Find(&notes).Error) }

Route registration confirms the endpoint has no AuthRequiredMiddleware (backend/handlers/notes.go:37), and the deleted flag is attacker-controlled (backend/handlers/notes.go:86 — Deleted bool with query:"deleted").

Proof of concept

A victim owns a public book (is_public = true), creates a note, then soft-deletes it (moves it to trash). The note still exists in the DB with deleted_at set.
An unauthenticated attacker who knows (or enumerates) the book UUID requests: GET /api/books//notes?deleted=true
The response lists the soft-deleted note(s) — id, title, slug, timestamps — even though the attacker is not authenticated and the owner intended the note to be deleted.

Impact

Exposure of soft-deleted note metadata (title, slug, timestamps) of public books to unauthenticated actors. The note body is not exposed — the content endpoint (GetNoteContent) does not use Unscoped(), so its count query returns 0 for soft-deleted notes and yields 404. Impact is therefore limited to metadata disclosure and the bypass of the intended "delete" semantics on public books.

Remediation

Restrict trash (soft-deleted) listings to the book owner only — never honor the is_public branch when deleted=true:

func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) { tx := db.DB if deleted { tx = tx.Unscoped() } + // Soft-deleted ("trash") notes must only ever be listed to the book owner. + authz := db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true) + if deleted { + authz = db.DB.Where("owner_id = ?", currentUserID) + } tx = tx. Preload("Book"). Joins("JOIN books ON books.id = notes.book_id"). Where( db.DB.Where("books.id = ?", bookID), - db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true), + authz, ) if deleted { tx = tx.Where("notes.deleted_at IS NOT NULL") } var notes []db.Note return notes, dbErrorToServiceError(tx.Find(&notes).Error) }

With this change, when currentUserID is nil (unauthenticated) and deleted=true, the clause becomes owner_id = NULL, which matches nothing — so trash is never exposed to anonymous callers.

Coordinated disclosure / CVE request

We have reported this privately and are happy to assist with any further validation or testing you need. If you agree this qualifies as a security vulnerability, we would be grateful if you could request a CVE ID for it — GitHub lets maintainers request a CVE directly from this advisory page once it is accepted. Thank you for your time and for maintaining note-mark.

References

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-285: Improper Authorization
Prior note-mark authorization fix (CVE-2026-40265) established that read paths must scope by owner_id OR is_public; this report covers the trash path that the scope did not fully cover.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/enchant97/note-mark/backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260601210758-9c9b72740f22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T13:41:29Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Summary\n\n  GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a \"deleted\" query parameter. When the request is ?deleted=true, the\n  service runs the query with Unscoped() (bypassing GORM\u0027s soft-delete scope) but keeps the read-authorization clause as \"owner_id = ? OR is_public\n  = ?\". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (\"trashed\") notes belonging to any public book \u2014 notes\n  the owner explicitly deleted and expected to be removed from public view.\n\n  Affected component (code-verified)\n\n  backend/services/notes.go \u2014 GetNotesByBookID (lines 72-89):\n\n  func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {\n        tx := db.DB\n        if deleted {\n                tx = tx.Unscoped() // \u003c-- bypasses soft-delete scope\n        }\n        tx = tx.\n                Preload(\"Book\").\n                Joins(\"JOIN books ON books.id = notes.book_id\").\n                Where(\n                        db.DB.Where(\"books.id = ?\", bookID),\n                        db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true), // \u003c-- is_public still honored for trash\n                )\n        if deleted {\n                tx = tx.Where(\"notes.deleted_at IS NOT NULL\")\n        }\n        var notes []db.Note\n        return notes, dbErrorToServiceError(tx.Find(\u0026notes).Error)\n  }\n\n  Route registration confirms the endpoint has no AuthRequiredMiddleware (backend/handlers/notes.go:37), and the deleted flag is attacker-controlled\n   (backend/handlers/notes.go:86 \u2014 Deleted bool with query:\"deleted\").\n\n  Proof of concept\n\n  1. A victim owns a public book (is_public = true), creates a note, then soft-deletes it (moves it to trash). The note still exists in the DB with\n  deleted_at set.\n  2. An unauthenticated attacker who knows (or enumerates) the book UUID requests: GET /api/books/\u003cbookID\u003e/notes?deleted=true\n  3. The response lists the soft-deleted note(s) \u2014 id, title, slug, timestamps \u2014 even though the attacker is not authenticated and the owner\n  intended the note to be deleted.\n\n  Impact\n\n  Exposure of soft-deleted note metadata (title, slug, timestamps) of public books to unauthenticated actors. The note body is not exposed \u2014 the\n  content endpoint (GetNoteContent) does not use Unscoped(), so its count query returns 0 for soft-deleted notes and yields 404. Impact is therefore\n   limited to metadata disclosure and the bypass of the intended \"delete\" semantics on public books.\n\n  Remediation\n\n  Restrict trash (soft-deleted) listings to the book owner only \u2014 never honor the is_public branch when deleted=true:\n\n   func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {\n        tx := db.DB\n        if deleted {\n                tx = tx.Unscoped()\n        }\n  +     // Soft-deleted (\"trash\") notes must only ever be listed to the book owner.\n  +     authz := db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true)\n  +     if deleted {\n  +             authz = db.DB.Where(\"owner_id = ?\", currentUserID)\n  +     }\n        tx = tx.\n                Preload(\"Book\").\n                Joins(\"JOIN books ON books.id = notes.book_id\").\n                Where(\n                        db.DB.Where(\"books.id = ?\", bookID),\n  -                     db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true),\n  +                     authz,\n                )\n        if deleted {\n                tx = tx.Where(\"notes.deleted_at IS NOT NULL\")\n        }\n        var notes []db.Note\n        return notes, dbErrorToServiceError(tx.Find(\u0026notes).Error)\n   }\n\n  With this change, when currentUserID is nil (unauthenticated) and deleted=true, the clause becomes owner_id = NULL, which matches nothing \u2014 so\n  trash is never exposed to anonymous callers.\n\n  Coordinated disclosure / CVE request\n\n  We have reported this privately and are happy to assist with any further validation or testing you need. If you agree this qualifies as a security\n   vulnerability, we would be grateful if you could request a CVE ID for it \u2014 GitHub lets maintainers request a CVE directly from this advisory page\n   once it is accepted. Thank you for your time and for maintaining note-mark.\n\n  References\n\n  - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n  - CWE-285: Improper Authorization\n  - Prior note-mark authorization fix (CVE-2026-40265) established that read paths must scope by owner_id OR is_public; this report covers the trash\n   path that the scope did not fully cover.\n\n  ---",
  "id": "GHSA-588f-fvcv-xhvf",
  "modified": "2026-07-09T13:41:29Z",
  "published": "2026-07-09T13:41:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/enchant97/note-mark"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-50554 (GCVE-0-2026-50554)

GHSA-588F-FVCV-XHVF

Tags

Sightings

Nomenclature