CVE-2026-40265 describes a missing authorization vulnerability (CWE-862) in the open-source Note Mark application prior to version 0.19.2. The asset download API endpoint (/api/notes/{noteID}/assets/{assetID}) lacks authentication middleware and does not verify whether the requester owns the note or if the associated book is visible. Consequently, an unauthenticated attacker with knowledge of valid note and asset identifiers can retrieve private note assets. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. The issue is resolved in version 0.19.2.

An unauthenticated attacker can access the full contents of private note assets without any authentication or authorization checks. This compromises the confidentiality of private notes stored in the affected versions of Note Mark. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Upgrade Note Mark to version 0.19.2 or later, where this authorization issue has been fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required.