CVE-2026-50554

Name of the Vulnerable Software and Affected Versions note-mark (affected versions not specified)

Description An unauthenticated user can access metadata of soft-deleted notes belonging to public books. This occurs because the endpoint '/api/books/{bookID}/notes' allows the use of a deleted query parameter that bypasses the soft-delete scope while still honoring the public visibility flag. Consequently, an attacker can enumerate the title, slug, and timestamps of notes that the owner intended to remove from public view. The issue is located in the GetNotesByBookID() function within the backend/services/notes.go file.

Recommendations Restrict the listing of soft-deleted notes exclusively to the book owner by ensuring the is public authorization branch is not honored when the deleted parameter is set to true. As a temporary mitigation, avoid using the deleted parameter in the '/api/books/{bookID}/notes' endpoint.