CVE-2026-50554: ENCHANT97 Note-Mark

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.

Affected products

• ENCHANT97 Note-Mark: before 0.19.5 (fixed in 0.19.5)

Published 2026-09-03. Last modified 2026-09-09.