CVE-2026-41571criticalCWE-287

CVE-2026-41571: falha crítica em enchant97 note-mark

Note Mark: OIDC-registered users authenticated by submitting password "null"

Publicada em

Seguir esta CVE+ Monitorar note-mark+ Monitorar github.com/enchant97/note-mark/backend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.4%
Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
enchant97 · note-mark
CVEs relacionadas — enchant97 note-mark

No mesmo produto, das mais perigosas para as menos.

CVE-2024-41819HIGHNote Mark has a stored XSS in the note link href attributeEPSS 0.8%CVE-2026-44522HIGHNote Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code ExecutionEPSS 0.6%CVE-2026-50553HIGHNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)EPSS 0.5%CVE-2026-40265MEDIUMNote Mark has Broken Access Control on Asset DownloadEPSS 0.4%CVE-2026-50554MEDIUMNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-markEPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.3%