Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-40265 Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered w… https://www.cve.org/CVERecord?id=CVE-2026-40265
Post summary
The statement lists a CVE for Mark and offers a technical detail of the affected endpoint, but it lacks any indication of an exploit, patch, or active threat.
CVE-2026-40265 Unauthenticated Asset Access in Note Mark Versions 0.19.1 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40265
Post summary
A link is provided to the CVE details for CVE-2026-40265, titled "Unauthenticated Asset Access in Note Mark Versions 0.19.1 and Prior", but the post offers no additional technical, exploit, patch, or active exploitation information.