{"id":"EUVD-2026-27053","enisaUuid":"871c6751-c234-3572-9c61-59d6d5063037","description":"Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM\u0027s soft-delete scope does not reach the raw \"JOIN books ...\" clauses used by the note and asset queries. This issue has been patched in version 0.19.3.","datePublished":"May 4, 2026, 5:44:01 PM","dateUpdated":"May 4, 2026, 7:39:55 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf\nhttps://github.com/enchant97/note-mark/releases/tag/v0.19.3\n","aliases":"CVE-2026-41572\nGHSA-3gr9-485j-v4xf\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"4d83e13d-6edc-394f-b71c-29f06f9dc5ed","product":{"name":"note-mark","vendor":{"name":"enchant97"}},"product_version":"\u003c 0.19.3"}],"enisaIdVendor":[{"id":"ff135ca9-595f-3382-9aee-7b0e2f78fdc9","vendor":{"name":"enchant97"}}],"enisaIdVulnerability":[{"id":"ade047e7-b6e6-384d-a3f9-5d603631ce6a","vulnerability":{"id":"GHSA-3gr9-485j-v4xf","description":"Note Mark: Unauthenticated read of notes and assets in soft-deleted public books","datePublished":"Apr 25, 2026, 11:40:37 PM","dateUpdated":"May 7, 2026, 8:20:15 PM","baseScore":0.0,"references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41572\nhttps://github.com/enchant97/note-mark/commit/d1bf845a2a2df01e2eca6f556287db4ec6f773cf\nhttps://github.com/enchant97/note-mark\nhttps://github.com/enchant97/note-mark/releases/tag/v0.19.3\n","enisa_id":"EUVD-2026-27053\n","aliases":"CVE-2026-41572\nGHSA-3gr9-485j-v4xf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bc06d765-15f9-3bf9-8c2a-fa3077975cfc","vulnerability":{"id":"CVE-2026-41572","description":"Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM\u0027s soft-delete scope does not reach the raw \"JOIN books ...\" clauses used by the note and asset queries. This issue has been patched in version 0.19.3.","datePublished":"May 4, 2026, 5:44:01 PM","dateUpdated":"May 4, 2026, 7:39:55 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf\nhttps://github.com/enchant97/note-mark/releases/tag/v0.19.3\n","enisa_id":"EUVD-2026-27053\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 5, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"72650f3b-0632-3e2b-aa2e-83a116984a77","product":{"name":"note-mark","vendor":{"name":"enchant97"}},"product_version":"\u003c 0.19.3"}],"vulnerabilityVendor":[{"id":"3d7409a8-1ae3-3bcb-be0d-789aed99d108","vendor":{"name":"enchant97"}}]}}],"enisaIdAdvisory":[]}