https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 04:08:52 +0000 https://vulnerability.circl.lu/vuln/cve-2026-50554 <p><strong>Affected:</strong> enchant97 note-mark</p> <p>Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a &#34;deleted&#34; query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM&#39;s soft-delete scope) but keeps the read-authorization clause as &#34;owner_id = ? OR is_public = ?&#34;. As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (&#34;trashed&#34;) notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.</p> <p><strong>Affected:</strong> enchant97 note-mark</p> <p>Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a &#34;deleted&#34; query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM&#39;s soft-delete scope) but keeps the read-authorization clause as &#34;owner_id = ? OR is_public = ?&#34;. As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (&#34;trashed&#34;) notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.</p> https://vulnerability.circl.lu/vuln/cve-2026-50554