Note Mark, a note‑taking application, had a flaw in its handling of soft‑deleted public books. Prior to version 0.19.3, deleting a public book did not hide its notes or assets; the API endpoints /api/notes/{id}, /api/notes/{id}/content, the slug URL, and asset links continued to return data. An attacker who learns a note identifier or a book slug can retrieve personal or business information without authentication, exposing confidential data. The weakness stems from GORM’s soft‑delete scope not applying to custom JOIN queries, identified as CWE‑285: Improper Access Control.

The product affected is Note Mark (enchant97:note-mark). Any installation running a version older than 0.19.3 is vulnerable. Version 0.19.3 and later contain the fix that prevents access to notes of soft‑deleted public books.

The CVSS score is 5.3, indicating medium impact. EPSS is not available, and the vulnerability is not in CISA KEV, marking it as a moderate risk. Because the flaw is exposed through public API endpoints, an unauthenticated attacker can retrieve data simply by requesting known URLs. No additional software or privilege escalation is required.