CVE-2026-40265mediumCWE-862

CVE-2026-40265: medium-severity vulnerability in enchant97 note-mark

Note Mark has Broken Access Control on Asset Download

Published · Updated

Follow this CVE+ Monitor note-mark+ Monitor github.com/enchant97/note-mark/backend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.4%
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
enchant97 · note-mark
Related CVEs — enchant97 note-mark

In the same product, most dangerous first.

CVE-2024-41819HIGHNote Mark has a stored XSS in the note link href attributeEPSS 0.8%CVE-2026-44522HIGHNote Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code ExecutionEPSS 0.6%CVE-2026-50553HIGHNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)EPSS 0.5%CVE-2026-50554MEDIUMNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-markEPSS 0.4%CVE-2026-41571CRITICALNote Mark: OIDC-registered users authenticated by submitting password "null"EPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.3%