CVE-2026-40265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40265", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T17:31:45.787Z", "datePublished": "2026-04-16T23:56:02.961Z", "dateUpdated": "2026-04-17T18:40:45.157Z"}, "containers": {"cna": {"title": "Note Mark has Broken Access Control on Asset Download", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p"}, {"name": "https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026", "tags": ["x_refsource_MISC"], "url": "https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026"}, {"name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.2"}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"version": "< 0.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T23:56:02.961Z"}, "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2."}], "source": {"advisory": "GHSA-p5w6-75f9-cc2p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T18:40:35.700177Z", "id": "CVE-2026-40265", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:40:45.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40265", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T18:40:35.700177Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:40:41.069Z"}}], "cna": {"title": "Note Mark has Broken Access Control on Asset Download", "source": {"advisory": "GHSA-p5w6-75f9-cc2p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "< 0.19.2"}]}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p", "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026", "name": "https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.2", "name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T23:56:02.961Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40265", "state": "PUBLISHED", "dateUpdated": "2026-04-17T18:40:45.157Z", "dateReserved": "2026-04-10T17:31:45.787Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-16T23:56:02.961Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "note-mark", "vendor": "enchant97", "versions": [{"status": "affected", "version": "< 0.19.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2."}, {"lang": "es", "value": "Note Mark es una aplicaci\u00f3n de c\u00f3digo abierto para tomar notas. En las versiones 0.19.1 y anteriores, el endpoint de descarga de activos en /api/notes/{noteID}/assets/{assetID} est\u00e1 registrado sin middleware de autenticaci\u00f3n, y la consulta del backend no verifica la propiedad o la visibilidad del libro. Un usuario no autenticado que conoce un ID de nota y un ID de activo v\u00e1lidos puede recuperar el contenido completo de activos de notas privadas sin autenticaci\u00f3n, independientemente de si el libro asociado es p\u00fablico o privado. Este problema ha sido solucionado en la versi\u00f3n 0.19.2."}], "id": "CVE-2026-40265", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40265", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T18:40:35.700177Z", "version": "2.0.3"}}]}, "published": "2026-04-17T01:17:40.293", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026"}, {"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.19.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "note-mark", "vendor": "enchant97"}], "analysis": {"en": {"generated_at": "2026-04-17T01:35:25.036242+00:00", "value": {"mitigation_remediation": ["Upgrade to Note Mark version 0.19.2 or later to apply the vendor\u2011supplied fix that enforces authentication and ownership checks.", "If an upgrade cannot be performed immediately, authenticate the asset download endpoint by adding middleware to verify that the requester is logged in before processing the request.", "Verify that private assets are only exposed to authorized users by implementing stricter access controls or disabling asset uploads on private books to prevent accidental exposure."], "summary": {"action": "Patch", "impact": "Unauthorized Access to Private Assets (Information Disclosure)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Note Mark application from vendor enchant97. All releases up to and including version 0.19.1 are impacted. Version 0.19.2 and later contain a fix that requires authentication and ownership checks for asset downloads.", "description_and_impact": "Note Mark allows an unauthenticated requester who knows a valid note ID and asset ID to download the full contents of private note assets. This breaks the intended access controls and leads to confidentiality compromise because any user can exfiltrate sensitive data that should be restricted to authorized owners or members of a book.", "risk_and_exploitability": "The CVSS score of 5.9 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a simple HTTP request to the asset download endpoint without any credentials, provided the attacker can guess or obtain a valid note and asset identifier. The risk is moderate due to the lack of authentication and the potential for data leakage, but the exploitation requires knowledge of specific identifiers."}}}}, "created": "2026-04-17T01:45:06.736102+00:00", "updated": "2026-04-17T08:01:19.231612+00:00", "vendors": ["enchant97", "enchant97$PRODUCT$note-mark"]}