CVE-2026-50554

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

• CWE-200
• CWE-285

• https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6
• https://github.com/enchant97/note-mark/releases/tag/v0.19.5
• https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf
• https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf

Published

Sep 3, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50549Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-5055NoMachine Uncontrolled Search Path Element Local Privilege E…7.8
• CVE-2026-50550Snipe-IT is an IT asset/license management system. Prior to …5.8
• CVE-2026-50551SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-50552Koel is a free, open-source music streaming solution. Prior …6.3
• CVE-2026-50553Note Mark is an open-source note-taking application. Prior t…8.6
• CVE-2026-50555Angular is a development platform for building mobile and de…6.1
• CVE-2026-50556Angular is a development platform for building mobile and de…6.1
• CVE-2026-50557Angular is a development platform for building mobile and de…6.1
• CVE-2026-50558Penelope Shell Handler is a post-exploitation shell handler …5.9
• CVE-2026-50559Quarkus is a Java framework for building cloud-native applic…7.5
• CVE-2026-5056GStreamer qtdemux Stack-based Buffer Overflow Remote Code Ex…7.8