Unauthenticated Data Exposure in Note Mark Application by Enchant97

CVE-2026-50554

What is CVE-2026-50554?

The Note Mark application, an open-source note-taking tool, contains a vulnerability where the unauthenticated endpoint GET /api/books/{bookID}/notes allows unauthorized users to access metadata of soft-deleted notes by utilizing the 'deleted' query parameter. This misconfiguration could lead to unauthorized exposure of sensitive data, enabling attackers to enumerate notes that users have deleted, thereby compromising the privacy and confidentiality of the application's users. The issue was resolved in version 0.19.5, emphasizing the importance of maintaining updated software to protect against vulnerabilities.

References