Encrypted Note Protection Bypass (Unauthorized Modification)

linkResolution: ❌

Not a bug

Note title/metadata is separate from note content and is not subject to Vault encryption


Summary
 
An attacker can modify encrypted notes (e.g., title) without providing the required password by manipulating API requests. This bypasses the intended protection mechanism for encrypted content.
 
Affected Endpoint
PATCH /v4/notes/{note_id}
 
https://www.amplenote.com/notes/
 
Vulnerability Type
Access Control Bypass
 
Business Logic Flaw
 
Improper Authorization on Protected Resource
 
Description
Encrypted notes require a password before allowing any modifications (e.g., editing title or content). However, this restriction is only enforced at the client level.
 
By intercepting a request from a non-encrypted note and replacing the note_id with that of an encrypted note, it is possible to update the encrypted note’s title without providing the password.
 
This demonstrates missing server-side validation for encryption state.
 
Steps to Reproduce
Purchase/enable subscription and create Note-A.
 
Encrypt Note-A with a password.
 
Confirm: You cannot edit title/content without entering password.
 
Create another note (Note-B) (non-encrypted).
 
Intercept a request while editing Note-B.
 
Modify the request:
 
Replace {note_id} with the ID of Note-A (encrypted note).
 
Example request:
 
PATCH /v4/notes/ac62e556-3582-11f1-95c7-fd098cc2f8b1
{"name":"note encryption bypass"}
Send the request.
 
Observe:
 
The encrypted note’s title is updated without a password.
 
Impact
Bypasses encryption protection mechanism.
 
Unauthorized modification of protected notes.
 
Breaks core confidentiality and integrity guarantees.
 
Could be extended to:
 
Modify sensitive metadata
 
Potentially tamper with protected content
 
Undermines user trust in encrypted notes feature.
 
Expected Behavior
Any modification to encrypted notes should require:
 
Password verification
 
Server-side validation of encryption state
 
Requests without proper authorization should be rejected.
 
Actual Behavior
Server accepts modification requests without verifying encryption/password.
 
Encrypted note metadata can be altered freely.
 
Recommendation
Enforce server-side validation for encrypted notes.
 
Require password/token verification before:
 
Editing title
 
Editing content
 
Any metadata updates
 
Bind encryption state checks directly to backend logic.
 
Do not rely on client-side enforcement.
 
Additional Note
This vulnerability indicates that encryption protections are not fully enforced at the API level, which may affect other encrypted operations.