Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark (CVE-2026-50554) | HOL Guard CVE

Medium · CVSS 5.3CVE-2026-50554GHSA-588F-FVCV-XHVF

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Answer in brief

CVE-2026-50554 records a Medium severity (CVSS 5.3) vulnerability in Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark. The current sources do not mark it as known exploited. The current feed maps enchant97/note-mark (generic), github.com/enchant97/note-mark/backend (go). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 3, 2026Updated Sep 9, 2026Source checked Sep 16, 2026First seen by HOL Jul 9, 2026Material review Sep 9, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.3
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps enchant97/note-mark (generic), github.com/enchant97/note-mark/backend (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
enchant97/note-markgeneric	< 0.19.5	Not reported
github.com/enchant97/note-mark/backendgo	<0.0.0-20260601210758-9c9b72740f22	0.0.0-20260601210758-9c9b72740f22

Recommended response

Check inventory. Check lockfiles and deployed manifests for enchant97/note-mark, github.com/enchant97/note-mark/backend.
Review the reported fix. Update github.com/enchant97/note-mark/backend to 0.0.0-20260601210758-9c9b72740f22 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 3, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 9, 2026

Sources and claim methodology

Upstream source description

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

Quoted source text, attributed separately from HOL analysis.