Note Mark allows an unauthenticated requester who knows a valid note ID and asset ID to download the full contents of private note assets. This breaks the intended access controls and leads to confidentiality compromise because any user can exfiltrate sensitive data that should be restricted to authorized owners or members of a book.

The vulnerability affects the Note Mark application from vendor enchant97. All releases up to and including version 0.19.1 are impacted. Version 0.19.2 and later contain a fix that requires authentication and ownership checks for asset downloads.

The CVSS score of 5.9 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a simple HTTP request to the asset download endpoint without any credentials, provided the attacker can guess or obtain a valid note and asset identifier. The risk is moderate due to the lack of authentication and the potential for data leakage, but the exploitation requires knowledge of specific identifiers.