CVE-2026-50554 enchant97 CVE debrief

Who should care

Defenders responsible for Note Mark installations should assess exposure and apply patches if available. Roles include security teams, system administrators, and developers who manage Note Mark deployments. They should verify exposure, prioritize patching, and monitor for exploitation attempts. Additionally, operators of public books and platforms hosting Note Mark should review compensating controls and ensure proper configuration to mitigate potential impacts. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and change management processes should be reviewed to ensure accurate tracking of affected systems and efficient remediation. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Those responsible for Note Mark's security posture should also consider the potential operational impacts, including the verification of Note Mark installations for exposure and the prioritization of patching for vulnerable instances. The affected operator should assess the risk of targeted attacks on public books and take appropriate measures to mitigate it. Platform administrators should ensure that proper security controls are in place to prevent unauthorized access to sensitive note metadata. Overall, a coordinated effort is necessary to address the potential risks associated with this vulnerability and to ensure the security of Note Mark installations. The CVE record and NVD entry provide details on the vulnerability, but additional information about affected versions and remediation steps is limited. Therefore, defenders should focus on verifying exposure and applying patches as a priority. They should also monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. By taking these steps, defenders can help mitigate the risks associated with CVE-2026-50554 and protect sensitive note metadata from potential enumeration by unauthenticated callers. The security of Note Mark installations depends on the prompt assessment and remediation,

Why it matters

CVE-2026-50554 allows unauthenticated enumeration of soft-deleted notes in Note Mark, potentially exposing sensitive metadata. Defenders should verify exposure, prioritize patching, and monitor for exploitation attempts.

• Potential enumeration of sensitive note metadata
• Increased risk of targeted attacks on public books
• Verification of Note Mark installations for exposure
• Prioritization of patching for vulnerable instances

Technical summary

The vulnerability exists in the GET /api/books/{bookID}/notes endpoint, which accepts a 'deleted' query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as 'owner_id = ? OR is_public = ?'. This allows any unauthenticated caller to enumerate the metadata of soft-deleted notes belonging to any public book.

Defensive priority

Defenders should prioritize verifying exposure of Note Mark installations to this vulnerability and apply patches if available.

Recommended defensive actions

• Verify Note Mark installations for exposure to this vulnerability by checking the current version and configuration.
• Apply patches if available, prioritizing version 0.19.5 or later.
• Monitor for potential exploitation attempts and review system logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information about affected versions and remediation steps is limited. Defenders should verify exposure by reviewing Note Mark installations, checking for the presence of version 0.19.5 or later, and ensuring that the GET /api/books/{bookID}/notes endpoint is properly configured. They should also monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. The lack of detailed information on affected versions and remediation steps requires a cautious approach, focusing on verifying exposure and applying patches as a priority.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.