CVE-2026-77438: Trilium unauthenticated share-search discloses password-protected and hidden shared notes
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Triliumto a version that resolves this vulnerability.Fixed in 0.104.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Trilium versions up to and including 0.103.0 are affected where notes are published within a shared subtree. Notes configured with share passwords or hidden from the navigation tree can still be exposed through the public share-search endpoint.
What does an attacker need to exploit this issue?
An attacker needs no authentication, privileges, or user interaction. They need to query the public share-search endpoint using an ancestor note in the published subtree.
What information can be disclosed?
Search results can disclose protected notes' titles, share identifiers, and hierarchical paths. Because searches match note content, repeated queries can also act as a boolean oracle to confirm substrings and recover content that should require a share password.
How can the issue be remediated?
Upgrade Trilium to version 0.104.0, which fixes the issue. Until upgraded, treat password-protected and hidden notes beneath published shared ancestors as potentially disclosed and avoid placing sensitive content in those shared subtrees.