VYPR
Get started
← All advisories
Medium severity5.9NVD Advisory· Published Apr 17, 2026· Updated Apr 17, 2026

CVE-2026-40265

CVE-2026-40265

Description

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/enchant97/note-mark/backendGo
< 0.0.0-20260411145023-6593898855ad0.0.0-20260411145023-6593898855ad

Affected products

1

Patches

1
6593898855ad

(backend) prevent CWE-862 for asset access

https://github.com/enchant97/note-markLeo SprattApr 10, 2026via ghsa
commit
2 files changed · +20 −2
  • backend/handlers/assets.go+3 −1 modified
    @@ -122,11 +122,13 @@ func (h AssetsHandler) GetNoteAssets(
 	}
 }
 
-// TODO Work out way to authenticate this
 func (h AssetsHandler) GetNoteAssetContentByID(
 	ctx context.Context,
 	input *GetNoteAssetContentByIDInput) (*huma.StreamResponse, error) {
+	authDetails, _ := h.AuthProvider.TryGetAuthDetails(ctx)
+	optionalUserUID := authDetails.GetOptionalUserID()
 	if asset, info, stream, err := h.AssetsService.GetNoteAssetContentByID(
+		optionalUserUID,
 		input.NoteID,
 		input.AssetID,
 		h.Storage); err != nil {
  • backend/services/assets.go+17 −1 modified
    @@ -2,6 +2,7 @@ package services
 
 import (
 	"io"
+	"log"
 
 	"github.com/enchant97/note-mark/backend/db"
 	"github.com/enchant97/note-mark/backend/storage"
@@ -94,11 +95,26 @@ func (s AssetsService) GetNoteAssets(
 }
 
 func (s AssetsService) GetNoteAssetContentByID(
+	currentUserID *uuid.UUID,
 	noteID uuid.UUID,
 	assetID uuid.UUID,
 	storage_backend storage.StorageController) (db.NoteAsset, storage.AssetFileInfo, io.ReadCloser, error) {
+	// check whether can get note asset
+	var noteExists int64
+	if err := db.DB.
+		Model(&db.Note{}).
+		Preload("Book").
+		Joins("JOIN books ON books.id = notes.book_id").
+		Where("owner_id = ? OR is_public = ?", currentUserID, true).
+		Where("notes.id = ?", noteID).
+		Count(&noteExists).Error; err != nil {
+		log.Println(err)
+		return db.NoteAsset{}, storage.AssetFileInfo{}, nil, dbErrorToServiceError(err)
+	} else if noteExists == 0 {
+		return db.NoteAsset{}, storage.AssetFileInfo{}, nil, NotFoundError
+	}
+	// get note asset
 	var noteAsset db.NoteAsset
-
 	if err := db.DB.
 		First(&noteAsset, "id = ? AND note_id = ?", assetID, noteID).
 		Error; err != nil {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.