CVE ID
CVE-2026-52111
Public URL
https://github.com/haierkeys/fast-note-sync-service/issues/268
Other details (optional)
The referenced public issue describes an authentication and authorization vulnerability chain in Fast Note Sync Service. Under the affected Docker deployment conditions, a remote attacker can self-register a normal account, bypass the administrator authorization check, obtain JWT signing material from an administrative configuration endpoint, and forge a token for an arbitrary user identifier when the machine identifier is empty, known, or predictable. Successful exploitation can result in arbitrary user impersonation, administrator account takeover, and unauthorized reading, modification, or deletion of synchronized notes and metadata.
Suggested CWE: CWE-863 (Incorrect Authorization), with CWE-321 (Use of Hard-coded Cryptographic Key) as a secondary weakness.
Suggested CVSS v4.0: 9.2 Critical
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
The exact affected-version and fixed-version ranges have not been confirmed by the project maintainer.
Fast Note Sync Service contains an authentication and authorization vulnerability chain that may allow a remote attacker to impersonate arbitrary users, including an administrator.
In the affected Docker deployment scenario, an attacker can register a normal account, bypass an administrator authorization check, retrieve JWT signing material from an administrative configuration endpoint, and forge a JWT for another user when the machine identifier is empty, known, or predictable.
The reported exploitation path requires:
- User registration to be enabled.
- The service to be deployed using Docker.
- The affected administrator authorization behavior to be present.
- The administrative configuration endpoint to expose JWT signing material.
- The machine identifier to be empty, known, or predictable.
The public report identifies the following vulnerability chain:
- Anonymous users can self-register.
- An
admin-uidvalue of0causes an incorrect administrator authorization result. - An administrative configuration endpoint exposes
authTokenKey. - User JWTs are signed using
authTokenKey + "_" + machine_id. - In the affected Docker path,
machine_idmay be empty, known, or predictable. - The exposed signing material can then be used to impersonate another user identifier.
Successful exploitation may result in:
- Arbitrary user impersonation.
- Administrator account takeover.
- Unauthorized access to private notes and metadata.
- Modification or deletion of synchronized content.
- CWE-863 — Incorrect Authorization
- CWE-321 — Use of Hard-coded Cryptographic Key (secondary)
Suggested CVSS v4.0 score: 9.2 — Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
The score is a researcher assessment and may be adjusted by the assigning CNA, MITRE, or NVD.
The exact affected-version range has not been confirmed by the project maintainer. Avoid claiming a precise version range until the maintainer or assigning CNA confirms it.
- Upgrade to a maintainer-confirmed fixed release.
- Disable public registration when it is not required.
- Correct the administrator authorization check and safely reject zero or unset administrator identifiers.
- Do not expose authentication keys or other secrets through configuration APIs.
- Generate a unique cryptographically random signing key for each installation.
- Rotate the signing key and invalidate existing sessions after applying the fix.
- Treat machine identifiers as non-secret metadata rather than cryptographic key material.
- Public report: haierkeys/fast-note-sync-service#268
- CVSS v4.0 specification: https://www.first.org/cvss/v4.0/specification-document
- CWE-863: https://cwe.mitre.org/data/definitions/863.html
- CWE-321: https://cwe.mitre.org/data/definitions/321.html