CVE-2026-73607
Fixed upstream EPSS <1%CVSS 5.8
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
Products: siyuan-note siyuan
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260812083335-251596fc0de2 |