CVE-2026-41572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41572", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T14:15:21.957Z", "datePublished": "2026-05-04T17:44:01.157Z", "dateUpdated": "2026-05-04T19:39:55.331Z"}, "containers": {"cna": {"title": "Note Mark: Unauthenticated read of notes and assets in soft-deleted public books", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf"}, {"name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3"}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"version": "< 0.19.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:44:01.157Z"}, "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw \"JOIN books ...\" clauses used by the note and asset queries. This issue has been patched in version 0.19.3."}], "source": {"advisory": "GHSA-3gr9-485j-v4xf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T19:39:34.473785Z", "id": "CVE-2026-41572", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T19:39:55.331Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41572", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T19:39:34.473785Z"}}}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T19:39:51.722Z"}}], "cna": {"title": "Note Mark: Unauthenticated read of notes and assets in soft-deleted public books", "source": {"advisory": "GHSA-3gr9-485j-v4xf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "< 0.19.3"}]}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf", "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw \"JOIN books ...\" clauses used by the note and asset queries. This issue has been patched in version 0.19.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:44:01.157Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41572", "state": "PUBLISHED", "dateUpdated": "2026-05-04T19:39:55.331Z", "dateReserved": "2026-04-21T14:15:21.957Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T17:44:01.157Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "note-mark", "vendor": "enchant97", "versions": [{"status": "affected", "version": "< 0.19.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw \"JOIN books ...\" clauses used by the note and asset queries. This issue has been patched in version 0.19.3."}, {"lang": "es", "value": "Note Mark es una aplicaci\u00f3n de c\u00f3digo abierto para tomar notas. Antes de la versi\u00f3n 0.19.3, despu\u00e9s de que un propietario de Note Mark elimina de forma l\u00f3gica un libro p\u00fablico, sus notas y activos cargados permanecen legibles en /API/notes/{id}, /API/notes/{id}/content, la URL del slug y los puntos finales de los activos. Llamadores no autenticados que poseen el ID de la nota o la ruta del slug conservan el acceso. El alcance de eliminaci\u00f3n l\u00f3gica de GORM no alcanza las cl\u00e1usulas \u2019JOIN books ...\u2019 sin procesar utilizadas por las consultas de notas y activos. Este problema ha sido parcheado en la versi\u00f3n 0.19.3."}], "id": "CVE-2026-41572", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41572", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T19:39:34.473785Z", "version": "2.0.3"}}]}, "published": "2026-05-04T18:16:29.763", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.19.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "note-mark", "source": "cna", "vendor": "enchant97"}, "product": "note-mark", "vendor": "enchant97"}], "created": "2026-05-04T19:30:02.684414+00:00", "updated": "2026-05-04T20:30:07.918203+00:00", "vendors": ["enchant97", "enchant97$PRODUCT$note-mark"]}