5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41572

CVE-2026-41572: Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries. This issue has been patched in version 0.19.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41572

CVE-2026-41572:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.0.0-20260417132843-d1bf845a2a2d	0.0.0-20260417132843-d1bf845a2a2d

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthenticated users to access notes and assets within a public book even after the book has been soft-deleted. This is a bypass of access controls (CWE-285).

The root cause is twofold:

Incomplete Deletion Logic: When a book is deleted via BooksService.DeleteBookByID, the operation is a soft-delete (setting the deleted_at field). However, the book's is_public status was not being changed. This meant the book was still considered 'public' in the database, even though the owner intended to make it inaccessible.
Improper Data Access Queries: Functions responsible for fetching notes and assets (e.g., NotesService.GetNoteByID) used raw SQL JOIN statements. These raw queries did not respect GORM's automatic soft-delete filtering. The queries checked if a book was public (is_public = true) but failed to check if the book had been soft-deleted (books.deleted_at IS NULL).

During exploitation, an unauthenticated attacker can request a note or asset using its ID or slug. The backend functions would query the database, and since the is_public check passes and the soft-delete check is missing, the data is returned to the attacker.

The provided patch addresses the first point by modifying DeleteBookByID to explicitly set is_public to false within the same transaction as the soft-delete. This effectively revokes public access upon deletion, mitigating the issue by preventing the vulnerable state from being created.

Vulnerable functions

BooksService.DeleteBookByID

backend/services/books.go

The original implementation of this function performs a soft-delete on a book but fails to update the `is_public` status. This leaves the book's notes and assets accessible to unauthenticated users because the read queries only check for the `is_public` flag and do not account for the soft-delete.

NotesService.GetNoteByID

backend/services/notes.go

This function fetches a note by its ID. The database query uses a raw `JOIN` with the `books` table and checks if the book `is_public`. However, it does not check if the book has been soft-deleted (`deleted_at IS NOT NULL`). This allows unauthenticated users to access notes of soft-deleted public books.

NotesService.GetNoteContentByID

backend/services/notes.go

This function, which serves the content of a note, is vulnerable to the same issue as `GetNoteByID`. It uses a query that checks if the parent book is public but fails to check if it has been soft-deleted, thus leaking note content to unauthenticated users.

NotesService.GetNoteBySlug

backend/services/notes.go

This function, which serves a note by its slug, is vulnerable to the same issue as `GetNoteByID`. It uses a query that checks if the parent book is public but fails to check if it has been soft-deleted, thus leaking note metadata to unauthenticated users.

AssetsService.GetAssetByID

backend/services/assets.go

Similar to the functions in `NotesService`, functions in `AssetsService` that fetch asset data are also vulnerable. They use a raw `JOIN` to the `books` table that does not filter out soft-deleted books, allowing unauthenticated access to assets within those books.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.