Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M
CVE-2026-40265Note Mark has Broken Access Control on Asset Download
Medium 5.9
In plain English
A medium-severity missing authorization in note-mark from enchant97. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/enchant97/note-mark/backend | 0.0.0-20260411145023-6593898855ad | GHSA-p5w6-75f9-cc2p |
| Go | github.com/enchant97/note-mark/backend | 0.0.0-20260411145023-6593898855ad | GO-2026-5530 |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N