Note Mark is an open‑source note‑taking platform that let users retrieve note metadata through a public API. The flaw allows an attacker to add the query parameter deleted=true to the GET /api/books/{bookID}/notes endpoint, which reads soft‑deleted notes while retaining the public‑or‑owner authorization filter. Any caller without authentication can therefore enumerate the metadata of notes that the owner has deleted but that belong to a public book, exposing data that should have been hidden, such as titles, timestamps, and deletion status. This fault is classified as an information disclosure vulnerability (CWE‑200) and also involves a privilege‑misuse weakness (CWE‑285).

The problem exists in the open‑source application Note Mark developed by enchant97. All releases prior to v0.19.5 contain the vulnerability; starting with v0.19.5 the bug is patched and the endpoint no longer leaks soft‑deleted note metadata.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, which is typical for less widely advertised flaws, and the vulnerability is not listed in CISA’s KEV catalog, meaning no mass exploitation has been documented. However, because the endpoint is publicly reachable and unauthenticated, an attacker can enumerate soft‑deleted notes simply by querying the API. The lack of authentication makes exploitation trivial; once discovered, the attacker can obtain the sensitive metadata exposed by the endpoint. The absence of a known exploit does not diminish the need to remediate, because the flaw is readily exploitable in a controlled manner and further exploitation could lead to deeper reconnaissance of the note‑taking platform.