5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40265

CVE-2026-40265: Note Mark has Broken Access Control on Asset Download

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40265

CVE-2026-40265:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.0.0-20260411145023-6593898855ad	0.0.0-20260411145023-6593898855ad

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a broken access control issue in the note-mark backend, allowing unauthenticated users to download private note assets given the correct UUIDs for the note and the asset. The root cause was the lack of authentication and authorization on the asset download endpoint.

The analysis of the fixing commit 6593898855add151eb9965d96998b05e14c62026 identified two key functions involved in the vulnerability:

AssetsHandler.GetNoteAssetContentByID in backend/handlers/assets.go: This function serves as the entry point for the vulnerable API endpoint. The patch introduced authentication by retrieving user details from the request context. Its previous implementation lacked any form of authentication, making it the initial point of failure.
AssetsService.GetNoteAssetContentByID in backend/services/assets.go: This function contains the core logic for fetching the asset. The patch added a critical authorization step, checking if the note is public or if the user is the owner. The original code was vulnerable because it retrieved assets based solely on their identifiers without verifying ownership or access rights.

An exploit would trigger a call to AssetsHandler.GetNoteAssetContentByID, which then calls AssetsService.GetNoteAssetContentByID. Both functions would therefore be present in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

AssetsHandler.GetNoteAssetContentByID

backend/handlers/assets.go

This function is the HTTP handler for the asset download endpoint. The patch adds authentication checks by extracting user details from the context. Before the patch, it directly called the service layer without any authentication, allowing unauthenticated access.

AssetsService.GetNoteAssetContentByID

backend/services/assets.go

This service layer function retrieves the asset. The patch adds an authorization check to verify if the user owns the note or if the note is public. The original implementation lacked this check, fetching the asset using only the note and asset IDs, thus allowing unauthorized access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.