CVE-2026-41571

{
  "id": "CVE-2026-41571",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T18:16:29.600",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: \"null\" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3."
    },
    {
      "lang": "es",
      "value": "Note Mark es una aplicación de código abierto para tomar notas. En la versión 0.19.2, IsPasswordMatch en backend/db/models.go recurre a un marcador de posición bcrypt(’null’) codificado siempre que un usuario no tiene una contraseña almacenada. Los usuarios registrados con OIDC se crean con una contraseña vacía, por lo que cualquiera que envíe password: ’null’ al endpoint de inicio de sesión interno recibe una sesión válida para ese usuario. La omisión no está autenticada y no requiere interacción del usuario. Este problema ha sido parcheado en la versión 0.19.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "enchant97",
          "product": "note-mark",
          "versions": [
            {
              "version": "= 0.19.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-04T20:20:49.852480Z",
          "id": "CVE-2026-41571",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}