CVE-2026-40263: low-severity vulnerability in enchant97 note-mark
Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.3%
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
enchant97 · note-markRelated CVEs — enchant97 note-mark
In the same product, most dangerous first.
CVE-2024-41819HIGHNote Mark has a stored XSS in the note link href attributeEPSS 0.8%CVE-2026-44522HIGHNote Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code ExecutionEPSS 0.6%CVE-2026-50553HIGHNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)EPSS 0.5%CVE-2026-40265MEDIUMNote Mark has Broken Access Control on Asset DownloadEPSS 0.4%CVE-2026-50554MEDIUMNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-markEPSS 0.4%CVE-2026-41571CRITICALNote Mark: OIDC-registered users authenticated by submitting password "null"EPSS 0.4%