CVE-2026-40265

🗓️ 16 Apr 2026 23:56:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 2 Views🌐 WEB

Note Mark allowed unauthenticated access to private note assets before version 0.19.2.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-40265	16 Apr 202623:56	–	attackerkb
Circl	CVE-2026-40265	13 Apr 202619:31	–	circl
CNNVD	Note Mark 安全漏洞	17 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40265 Note Mark has Broken Access Control on Asset Download	16 Apr 202623:56	–	cvelist
Github Security Blog	Note Mark has Broken Access Control on Asset Download	13 Apr 202619:31	–	github
NVD	CVE-2026-40265	17 Apr 202601:17	–	nvd
OSV	GHSA-P5W6-75F9-CC2P Note Mark has Broken Access Control on Asset Download	13 Apr 202619:31	–	osv
Positive Technologies	PT-2026-32120	11 Apr 202600:00	–	ptsecurity
Snyk	Missing Authorization	17 Apr 202601:38	–	snyk
Snyk	Missing Authorization	17 Apr 202601:38	–	snyk

Vulners

Node

enchant97 note-markRange<0.19.2

[
  {
    "vendor": "enchant97",
    "product": "note-mark",
    "versions": [
      {
        "version": "< 0.19.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/enchant97/note-mark/commit/6593898855add151eb9965d96998b05e14c62026
github	www.github.com/enchant97/note-mark/releases/tag/v0.19.2
github	www.github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p

Parameter	Position	Path	Description	CWE
noteID	path	/api/notes/{noteID}/assets/{assetID}	Unauthenticated access to private note assets via asset download endpoint.	CWE-862
assetID	path	/api/notes/{noteID}/assets/{assetID}	Unauthenticated access to private note assets via asset download endpoint.	CWE-862

17 Apr 2026 15:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

EPSS0.00044

SSVC

CWE-862