Skip to content
OpenAdvisories

Package · Go

github.com/enchant97/note-mark/backend

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-50554

    Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

    Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() …

    enchant97 note-mark github.com/enchant97/note-mark/backend Go
  • Medium 5.3
    CVE-2026-41572

    Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

    Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. U…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go
  • Medium 5.9
    CVE-2026-40265

    Note Mark has Broken Access Control on Asset Download

    Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book vis…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go