https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:47:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308470 EUVD-2026-308470 https://cve.radiocsirt.org/vuln/euvd-2026-308470 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41572 <p>Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM&#39;s soft-delete scope does not reach the raw &#34;JOIN books ...&#34; clauses used by the note and asset queries. This issue has been patched in version 0.19.3.</p> <p>Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM&#39;s soft-delete scope does not reach the raw &#34;JOIN books ...&#34; clauses used by the note and asset queries. This issue has been patched in version 0.19.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41572 https://cve.radiocsirt.org/vuln/ghsa-3gr9-485j-v4xf <p><strong>Affected:</strong> Go: github.com/enchant97/note-mark/backend</p> <p>## Summary</p> <p>After a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at `/api/notes/{id}`, `/api/notes/{id}/content`, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM&#39;s soft-delete scope does not reach the raw `JOIN books ...` clauses used by the note and asset queries.</p> <p>## Details</p> <p>`DELETE /api/books/{bookID}` sets `books.deleted_at` to the current time. The book-level endpoint starts returning 404, which matches the owner&#39;s expectation that the book is gone. The note service and asset service query notes with a raw join that does not filter `books.deleted_at IS NULL`:</p> <p>```go // backend/services/notes.go:91-98 (GetNoteByID) func (s NotesService) GetNoteByID(currentUserID *uuid.UUID, noteID uuid.UUID) (db.Note, error) { var note db.Note return note, dbErrorToServiceError(db.DB. Preload(&#34;Book&#34;). Joins(&#34;JOIN books ON books.id = notes.book_id&#34;). Where(&#34;owner_id = ? OR is_public = ?&#34;, currentUserID, true). First(&amp;note, &#34;notes.id = ?&#34;, noteID).Error) } ```</p> <p>GORM applies its soft-delete scope to the primary model of a query (here, `notes`) and to implicit `Joins(&#34;Book&#34;)` association clauses. It does not rewrite raw SQL passed to `Joins`. The soft-deleted book row keeps `is_public = true`, so the `WHERE owner_id = ? OR is_public = ?` clause still evaluates true for any caller on a book that was public at deletion time. For an unauthe…</p> <p><strong>Affected:</strong> Go: github.com/enchant97/note-mark/backend</p> <p>## Summary</p> <p>After a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at `/api/notes/{id}`, `/api/notes/{id}/content`, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM&#39;s soft-delete scope does not reach the raw `JOIN books ...` clauses used by the note and asset queries.</p> <p>## Details</p> <p>`DELETE /api/books/{bookID}` sets `books.deleted_at` to the current time. The book-level endpoint starts returning 404, which matches the owner&#39;s expectation that the book is gone. The note service and asset service query notes with a raw join that does not filter `books.deleted_at IS NULL`:</p> <p>```go // backend/services/notes.go:91-98 (GetNoteByID) func (s NotesService) GetNoteByID(currentUserID *uuid.UUID, noteID uuid.UUID) (db.Note, error) { var note db.Note return note, dbErrorToServiceError(db.DB. Preload(&#34;Book&#34;). Joins(&#34;JOIN books ON books.id = notes.book_id&#34;). Where(&#34;owner_id = ? OR is_public = ?&#34;, currentUserID, true). First(&amp;note, &#34;notes.id = ?&#34;, noteID).Error) } ```</p> <p>GORM applies its soft-delete scope to the primary model of a query (here, `notes`) and to implicit `Joins(&#34;Book&#34;)` association clauses. It does not rewrite raw SQL passed to `Joins`. The soft-deleted book row keeps `is_public = true`, so the `WHERE owner_id = ? OR is_public = ?` clause still evaluates true for any caller on a book that was public at deletion time. For an unauthe…</p> https://cve.radiocsirt.org/vuln/ghsa-3gr9-485j-v4xf