Note Mark versions prior to 0.19.2 have a missing authorization vulnerability (CWE-862) in the /api/notes/{noteID}/assets/{assetID} endpoint. This endpoint is exposed without authentication middleware and does not check whether the requester owns the note or if the note's book is public or private. Consequently, an attacker with knowledge of valid note and asset identifiers can retrieve private note assets without any authentication. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. The issue is resolved in version 0.19.2.

An unauthenticated attacker can access the full contents of private note assets by exploiting the lack of authorization checks on the asset download endpoint. This leads to unauthorized disclosure of potentially sensitive information stored in private notes. There is no indication of impact to integrity or availability. No known exploits in the wild have been reported.

Upgrade Note Mark to version 0.19.2 or later, where this authorization issue has been fixed. Since the vulnerability is addressed in this version, no additional mitigation is required.