CVE-2026-40265

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40265

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40265.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40265

Aliases

Published

2026-04-16T23:56:02.961Z

Modified

2026-07-08T08:13:12.445075882Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Note Mark has Broken Access Control on Asset Download

Details

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40265.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/enchant97/note-mark

Affected ranges

Type

GIT

Repo

https://github.com/enchant97/note-mark

Events

Introduced

Fixed

6593898855add151eb9965d96998b05e14c62026

Fixed

9f627bbb0cccebf872ec4b450ba2cd1d59ba9697

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.19.2"
        }
    ]
}

Affected versions

v0.*

v0.10.0

v0.11.0

v0.11.1

v0.12.0

v0.12.1

v0.12.2

v0.13.0

v0.13.1

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.15.4

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.18.0

v0.19.0

v0.19.1

v0.6.0

v0.6.0-alpha

v0.6.0-alpha.2

v0.6.0-alpha.3

v0.6.0-alpha.4

v0.7.0

v0.8.0

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40265.json"