enchant97 note-mark up to 0.19.1 Asset Download Endpoint assets authorization

Summaryinfo

A vulnerability classified as problematic was found in enchant97 note-mark up to 0.19.1. Affected is an unknown function of the file /api/notes/{noteID}/assets/ of the component Asset Download Endpoint. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-40265. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in enchant97 note-mark up to 0.19.1. This vulnerability affects an unknown function of the file /api/notes/{noteID}/assets/ of the component Asset Download Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. CVE summarizes:

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-40265 since 04/10/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 6593898855add151eb9965d96998b05e14c62026 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• enchant97

Name

• note-mark

Version

• 0.19.0
• 0.19.1

License

• open-source

Website

• Product: https://github.com/enchant97/note-mark/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion