CVE-2026-77438: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in TriliumNext Trilium

In TriliumNext Trilium versions up to 0.103.0, the public share-search endpoint improperly authorizes access by only validating the ancestor note in a request and then performing a full-text search across the published subtree. It returns matching notes' titles, share identifiers, and hierarchical paths without verifying if each note requires a share password or is hidden from the navigation tree. This flaw allows unauthenticated attackers to enumerate and read the contents of protected notes by using the endpoint as a boolean oracle for substring matching. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-863 (Incorrect Authorization). The issue is resolved in version 0.104.0.

An unauthenticated attacker can bypass access controls on protected shared notes, gaining unauthorized read access to sensitive note titles, paths, and full content. This exposure compromises confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

Upgrade Trilium to version 0.104.0 or later, where this vulnerability is fixed. There is no official patch or temporary workaround documented. Until upgrading, restrict access to the public share-search endpoint if possible to prevent unauthorized information disclosure.