CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes
Unauthenticated attackers can bypass password and visibility controls on shared notes via the search endpoint, disclosing protected content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77438?
CVE-2026-77438 is a high-severity missing authorization vulnerability in TriliumNext Trilium, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0.
Which versions are affected by CVE-2026-77438?
It affects 1 product.
Products include Triliumnotes Trilium.
How do I fix CVE-2026-77438?
No fix has been published for CVE-2026-77438 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77438 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77438 exists.
Other vulnerabilities in TriliumNext Trilium
- CVE-2026-48996 Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
- CVE-2026-53578 Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
- CVE-2026-53579 Trilium: Note Import to RCE via Book Note
- CVE-2026-47727 Code injection in Trilium
- CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Sources
Also known as GHSA-6rxv-6w3q-7mv9.