GHSA-588F-FVCV-XHVF
Vulnerability from github – Published: 2026-07-09 13:41 – Updated: 2026-07-09 13:41Summary
GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view.
Affected component (code-verified)
backend/services/notes.go — GetNotesByBookID (lines 72-89):
func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) { tx := db.DB if deleted { tx = tx.Unscoped() // <-- bypasses soft-delete scope } tx = tx. Preload("Book"). Joins("JOIN books ON books.id = notes.book_id"). Where( db.DB.Where("books.id = ?", bookID), db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true), // <-- is_public still honored for trash ) if deleted { tx = tx.Where("notes.deleted_at IS NOT NULL") } var notes []db.Note return notes, dbErrorToServiceError(tx.Find(¬es).Error) }
Route registration confirms the endpoint has no AuthRequiredMiddleware (backend/handlers/notes.go:37), and the deleted flag is attacker-controlled (backend/handlers/notes.go:86 — Deleted bool with query:"deleted").
Proof of concept
- A victim owns a public book (is_public = true), creates a note, then soft-deletes it (moves it to trash). The note still exists in the DB with deleted_at set.
- An unauthenticated attacker who knows (or enumerates) the book UUID requests: GET /api/books//notes?deleted=true
- The response lists the soft-deleted note(s) — id, title, slug, timestamps — even though the attacker is not authenticated and the owner intended the note to be deleted.
Impact
Exposure of soft-deleted note metadata (title, slug, timestamps) of public books to unauthenticated actors. The note body is not exposed — the content endpoint (GetNoteContent) does not use Unscoped(), so its count query returns 0 for soft-deleted notes and yields 404. Impact is therefore limited to metadata disclosure and the bypass of the intended "delete" semantics on public books.
Remediation
Restrict trash (soft-deleted) listings to the book owner only — never honor the is_public branch when deleted=true:
func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) { tx := db.DB if deleted { tx = tx.Unscoped() } + // Soft-deleted ("trash") notes must only ever be listed to the book owner. + authz := db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true) + if deleted { + authz = db.DB.Where("owner_id = ?", currentUserID) + } tx = tx. Preload("Book"). Joins("JOIN books ON books.id = notes.book_id"). Where( db.DB.Where("books.id = ?", bookID), - db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true), + authz, ) if deleted { tx = tx.Where("notes.deleted_at IS NOT NULL") } var notes []db.Note return notes, dbErrorToServiceError(tx.Find(¬es).Error) }
With this change, when currentUserID is nil (unauthenticated) and deleted=true, the clause becomes owner_id = NULL, which matches nothing — so trash is never exposed to anonymous callers.
Coordinated disclosure / CVE request
We have reported this privately and are happy to assist with any further validation or testing you need. If you agree this qualifies as a security vulnerability, we would be grateful if you could request a CVE ID for it — GitHub lets maintainers request a CVE directly from this advisory page once it is accepted. Thank you for your time and for maintaining note-mark.
References
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285: Improper Authorization
- Prior note-mark authorization fix (CVE-2026-40265) established that read paths must scope by owner_id OR is_public; this report covers the trash path that the scope did not fully cover.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/enchant97/note-mark/backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260601210758-9c9b72740f22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50554"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-285"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T13:41:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Summary\n\n GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a \"deleted\" query parameter. When the request is ?deleted=true, the\n service runs the query with Unscoped() (bypassing GORM\u0027s soft-delete scope) but keeps the read-authorization clause as \"owner_id = ? OR is_public\n = ?\". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted (\"trashed\") notes belonging to any public book \u2014 notes\n the owner explicitly deleted and expected to be removed from public view.\n\n Affected component (code-verified)\n\n backend/services/notes.go \u2014 GetNotesByBookID (lines 72-89):\n\n func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {\n tx := db.DB\n if deleted {\n tx = tx.Unscoped() // \u003c-- bypasses soft-delete scope\n }\n tx = tx.\n Preload(\"Book\").\n Joins(\"JOIN books ON books.id = notes.book_id\").\n Where(\n db.DB.Where(\"books.id = ?\", bookID),\n db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true), // \u003c-- is_public still honored for trash\n )\n if deleted {\n tx = tx.Where(\"notes.deleted_at IS NOT NULL\")\n }\n var notes []db.Note\n return notes, dbErrorToServiceError(tx.Find(\u0026notes).Error)\n }\n\n Route registration confirms the endpoint has no AuthRequiredMiddleware (backend/handlers/notes.go:37), and the deleted flag is attacker-controlled\n (backend/handlers/notes.go:86 \u2014 Deleted bool with query:\"deleted\").\n\n Proof of concept\n\n 1. A victim owns a public book (is_public = true), creates a note, then soft-deletes it (moves it to trash). The note still exists in the DB with\n deleted_at set.\n 2. An unauthenticated attacker who knows (or enumerates) the book UUID requests: GET /api/books/\u003cbookID\u003e/notes?deleted=true\n 3. The response lists the soft-deleted note(s) \u2014 id, title, slug, timestamps \u2014 even though the attacker is not authenticated and the owner\n intended the note to be deleted.\n\n Impact\n\n Exposure of soft-deleted note metadata (title, slug, timestamps) of public books to unauthenticated actors. The note body is not exposed \u2014 the\n content endpoint (GetNoteContent) does not use Unscoped(), so its count query returns 0 for soft-deleted notes and yields 404. Impact is therefore\n limited to metadata disclosure and the bypass of the intended \"delete\" semantics on public books.\n\n Remediation\n\n Restrict trash (soft-deleted) listings to the book owner only \u2014 never honor the is_public branch when deleted=true:\n\n func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {\n tx := db.DB\n if deleted {\n tx = tx.Unscoped()\n }\n + // Soft-deleted (\"trash\") notes must only ever be listed to the book owner.\n + authz := db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true)\n + if deleted {\n + authz = db.DB.Where(\"owner_id = ?\", currentUserID)\n + }\n tx = tx.\n Preload(\"Book\").\n Joins(\"JOIN books ON books.id = notes.book_id\").\n Where(\n db.DB.Where(\"books.id = ?\", bookID),\n - db.DB.Where(\"owner_id = ? OR is_public = ?\", currentUserID, true),\n + authz,\n )\n if deleted {\n tx = tx.Where(\"notes.deleted_at IS NOT NULL\")\n }\n var notes []db.Note\n return notes, dbErrorToServiceError(tx.Find(\u0026notes).Error)\n }\n\n With this change, when currentUserID is nil (unauthenticated) and deleted=true, the clause becomes owner_id = NULL, which matches nothing \u2014 so\n trash is never exposed to anonymous callers.\n\n Coordinated disclosure / CVE request\n\n We have reported this privately and are happy to assist with any further validation or testing you need. If you agree this qualifies as a security\n vulnerability, we would be grateful if you could request a CVE ID for it \u2014 GitHub lets maintainers request a CVE directly from this advisory page\n once it is accepted. Thank you for your time and for maintaining note-mark.\n\n References\n\n - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n - CWE-285: Improper Authorization\n - Prior note-mark authorization fix (CVE-2026-40265) established that read paths must scope by owner_id OR is_public; this report covers the trash\n path that the scope did not fully cover.\n\n ---",
"id": "GHSA-588f-fvcv-xhvf",
"modified": "2026-07-09T13:41:29Z",
"published": "2026-07-09T13:41:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf"
},
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/commit/9c9b72740f22a06131a8f64b53bb08e3b05b81a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/enchant97/note-mark"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.