GHSA-588f-fvcv-xhvf Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books
SummaryGET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the
  service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public
  = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes
  the owner explicitly deleted and expected to be removed from public view.Affected component (code-verified)backend/services/notes.go — GetNotesByBookID (lines 72-89):func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {
        tx := db.DB
        if deleted {
                tx = tx.Unscoped() // <-- bypasses soft-delete scope
        }
        tx = tx.
                Preload("Book").
                Joins("JOIN books ON books.id = notes.book_id").
                Where(
                        db.DB.Where("books.id = ?", bookID),
                        db.DB.Where("owner_id = ? OR is_public = ?", currentUserID, true), // <-- is_public still honored for trash
                )
        if deleted {
                tx = tx.Where("notes.deleted_at IS NOT NULL")
        }
        var notes []db.Note
        return notes, dbErrorToServiceError(tx.Find(&notes).Error)
  }Route registration confirms the endpoint has no AuthRequiredMiddleware (backend/handlers/notes.go:37), and the deleted flag is attacker-controlled
   (backend/handlers/notes.go:86 — Deleted bool with query:"deleted").Proof of conceptA victim owns a public book (is_public = true), creates a note, then soft-deletes it (moves it to trash). The note still exists in the DB with
deleted_at set.An unauthenticated attacker who knows (or enumerates) the book UUID requests: GET /api/books/<bookID>/notes?deleted=trueThe response lists the soft-deleted note(s) — id, title, slug, timestamps — even though the attacker is not authenticated and the owner
intended the note to be deleted.ImpactExposure of soft-deleted note metadata (title, slug, timestamps) of public books to unauthenticated actors. The note body is not exposed — the
  content endpoint (GetNoteContent) does not use Unscoped(), so its count query returns 0 for soft-deleted notes and yields 404. Impact is therefore
   limited to metadata disclosure and the bypass of the intended "delete" semantics on public books.RemediationRestrict trash (soft-deleted) listings to the book owner only — never honor the is_public branch when deleted=true:func (s NotesService) GetNotesByBookID(currentUserID *uuid.UUID, bookID uuid.UUID, deleted bool) ([]db.Note, error) {
        tx := db.DB
        if deleted {
                tx = tx.Unscoped()
        }}With this change, when currentUserID is nil (unauthenticated) and deleted=true, the clause becomes owner_id = NULL, which matches nothing — so
  trash is never exposed to anonymous callers.Coordinated disclosure / CVE requestWe have reported this privately and are happy to assist with any further validation or testing you need. If you agree this qualifies as a security
   vulnerability, we would be grateful if you could request a CVE ID for it — GitHub lets maintainers request a CVE directly from this advisory page
   once it is accepted. Thank you for your time and for maintaining note-mark.ReferencesCWE-200: Exposure of Sensitive Information to an Unauthorized ActorCWE-285: Improper AuthorizationPrior note-mark authorization fix (CVE-2026-40265) established that read paths must scope by owner_id OR is_public; this report covers the trash
path that the scope did not fully cover.
CVSS v3.1 score: 5.3