CVE-2026-77438 TriliumNext CVE debrief

Who should care

Defenders responsible for Trilium installations, especially those using public share-search endpoints, should assess exposure and take remediation steps. This includes verifying the version of Trilium in use, reviewing note access controls, and ensuring that shareCredentials and shareHiddenFromTree controls are properly enforced. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-77438 allows unauthenticated access to protected Trilium notes. Defenders should verify exposure, prioritize upgrading to version 0.104.0, and review note access controls.

• Potential unauthorized access to sensitive note content.
• Enumeration of protected notes through search functionality.
• Possible use of the search endpoint as a boolean oracle to recover note contents.
• Verification of note protection and access controls is required.

Technical summary

The public share-search endpoint in Trilium versions up to and including 0.103.0 does not properly enforce per-note shareCredentials and shareHiddenFromTree controls. This allows an unauthenticated visitor to search across the entire published subtree and retrieve titles, share identifiers, and hierarchical paths of matching notes, potentially exposing protected notes. The issue is fixed in version 0.104.0. Defenders should prioritize verifying exposure of Trilium installations to this vulnerability and upgrading to version 0.104.0 if vulnerable.

Defensive priority

Defenders should prioritize verifying exposure of Trilium installations to this vulnerability and upgrading to version 0.104.0 if vulnerable.

Recommended defensive actions

• Verify Trilium installation version and check if it is vulnerable (<= 0.103.0).
• Upgrade to version 0.104.0 or later if vulnerable.
• Review and adjust shareCredentials and shareHiddenFromTree controls for notes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 0.104.0. The public share-search endpoint in Trilium versions up to and including 0.103.0 does not properly enforce per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to search across the entire published subtree and retrieve titles, share identifiers, and hierarchical paths of matching notes, potentially exposing protected notes. Defenders should verify exposure of Trilium installations to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.