ZeroDay Findings
Sign inSign up

Findings

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application.

Published Aug 27, 2026 · updated Oct 14, 2026 · triliumnotes trilium

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 27, 2026 · NIST NVD

    Detected

    Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and

  2. Oct 14, 2026 · NIST NVD

    Updated

    Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and

Affected

  • cpe triliumnotes/triliumversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-77438

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-77438

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-77438

    Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree

    nvd.nist.gov

References