{"answers":{"affected":"3 open source packages ship an affected version, including github.com/enchant97/note-mark/backend.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40263 exists.","fix":"Upgrade github.com/enchant97/note-mark/backend to 0.19.2-0.20260411145025-cf4c6f6acf70 or later.","what":"CVE-2026-40263 is a low-severity vulnerability in enchant97 note-mark, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-40263 and fix it if it is affected.\n\nWhat it is: CVE-2026-40263 is a low-severity vulnerability in enchant97 note-mark, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40263 exists.\n\nAffected packages and fixed versions:\n- github.com/enchant97/note-mark/backend (Go): affected all versions; no fix listed\n- github.com/enchant97/note-mark/backend (Go): affected all versions; fixed in 0.19.2-0.20260411145025-cf4c6f6acf70\n- github.com/enchant97/note-mark/backend (Go): affected all versions; fixed in 0.19.2-0.20260411145025-cf4c6f6acf70\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-40263/ (Markdown: https://insights.sbomify.com/CVE-2026-40263/index.md)","id":"CVE-2026-40263","markdown":"https://insights.sbomify.com/CVE-2026-40263/index.md","name":"CVE-2026-40263","record":{"aliases":["GHSA-w6m9-39cv-2fwp","GO-2026-5696"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Note Mark application","requires_auth":"none","summary":"Unauthenticated attackers can enumerate valid usernames via timing side-channels in the login endpoint, facilitating targeted credential attacks.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-208","name":"Observable Timing Discrepancy"}],"description":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel","id":"CVE-2026-40263","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation","id":"CVE-2026-40264"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/enchant97/note-mark/backend","purl":"pkg:golang/github.com/enchant97/note-mark/backend","source":"GO-2026-5696"},{"ecosystem":"Go","fixed":["0.19.2-0.20260411145025-cf4c6f6acf70"],"introduced":["0"],"last_affected":[],"package":"github.com/enchant97/note-mark/backend","purl":null,"source":"GHSA-w6m9-39cv-2fwp"},{"ecosystem":"Go","fixed":["0.19.2-0.20260411145025-cf4c6f6acf70"],"introduced":["0"],"last_affected":[],"package":"github.com/enchant97/note-mark/backend","purl":"pkg:golang/github.com/enchant97/note-mark/backend","source":"GHSA-w6m9-39cv-2fwp"}],"prev":{"headline":"Note Mark has Stored XSS via Unrestricted Asset Upload","id":"CVE-2026-40262"},"products":["note-mark"],"published":"2026-04-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-04-17","vendors":["enchant97"]},"summary":"Unauthenticated attackers can enumerate valid usernames via timing side-channels in the login endpoint, facilitating targeted credential attacks.","url":"https://insights.sbomify.com/CVE-2026-40263/"}