CyberRota Analysis
AI-GeneratedThe Note Mark application prior to version 0.19.5 contains a vulnerability in its unauthenticated API endpoint that allows attackers to enumerate metadata of soft-deleted notes from public books by manipulating the "deleted" query parameter. This exposure can lead to unauthorized access to sensitive information that users intended to be private. Organizations using affected versions should prioritize patching to version 0.19.5 to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.