PT-2026-32120 · Note Mark · Note Mark

Published 2026-04-11 · Updated 2026-04-17 · CVE-2026-40265

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.2

Description A broken access control issue exists in the asset download endpoint '/api/notes/{noteID}/assets/{assetID}'. The endpoint is registered without authentication middleware, and the backend query fails to verify ownership or book visibility. An unauthenticated user who possesses a valid noteID and assetID can retrieve the full contents of private note assets, regardless of whether the associated book is public or private. This occurs because the retrieval process only queries the asset table by ID and does not check if the requester owns the parent book or if the book is private.

Recommendations Update to version 0.19.2. As a temporary workaround, restrict access to the '/api/notes/{noteID}/assets/{assetID}' endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40265

GHSA-P5W6-75F9-CC2P

Affected Products

Note Mark

References · 10

• https://osv.dev/vulnerability/GHSA-p5w6-75f9-cc2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40265 · Security Note
• https://github.com/enchant97/note-mark · Note
• https://github.com/enchant97/note-mark/releases/tag/v0.19.2 · Note
• https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p · Note
• https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026 · Note
• https://twitter.com/VulmonFeeds/status/2044953367667990864 · Twitter Post
• https://twitter.com/CVEnew/status/2045102626115670067 · Twitter Post
• https://reddit.com/r/enchantedcode/comments/1silry3/note_mark_v0192_security_update · Reddit Post
• https://reddit.com/r/selfhosted/comments/1sim2hk/note_mark_v0192_security_update · Reddit Post