Unauthenticated Access Vulnerability in Note-taking Application Note Mark

CVE-2026-40265

What is CVE-2026-40265?

Note Mark, an open-source note-taking application, has a vulnerability in versions 0.19.1 and earlier that allows unauthenticated users to access private note assets. The asset download endpoint located at /api/notes/{noteID}/assets/{assetID} lacks authentication middleware, which results in unauthorized access to private content as long as the attacker knows a valid note ID and asset ID. This flaw compromises the confidentiality of private notes and their associated books, as it does not enforce ownership or visibility checks. This issue has been resolved in version 0.19.2.

References