Note Mark
  • Support The Project

    • Security Disclosures - 2026-04

    Stored XSS via Unrestricted Asset Upload

    If a user clicked on a note asset or opened a asset link from another service the browser could open a html file and execute it. Meaning any attacker could gain access to the Note Mark API.

    This attack would require the attacker to have an account on the Note Mark server and force the victim to click on a link, which could be possible if the attacker had a shared note with the victim.

    Fixed by disabling browser based content sniffing and ensuring exploitable content types cannot load in the browser window by marking them as application/octet-stream and setting content disposition to “attachment”.

    Broken Access Control on Asset Download

    Any assets that are added to a note can be accessed without any authentication needed. The attacker would need to know the note UUID and asset UUID, so unlikely exploitable.

    Fixed by adding authentication check on asset route.

    Username Enumeration via Login Endpoint

    When using the internal login system, the api can reveal whether a username exists or not due to the password hash compare function only running when there is a valid user.

    Fixed by adding a default password to check against when no user exists.

    DOMPurify (dependency)

    Unauthenticated read of notes and assets in soft-deleted public books

    Notes and assets can still be accessed when a book has been soft-deleted on any book that was made public.

    Fixed by removing public access when soft-deleted.

    OIDC-registered users authenticated by submitting password “null”

    Any OIDC registered users that have not got an internal password set can login using the password “null”.

    Only effects users that have a user with no password set.