CVE-2026-72790
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.
Risk Assessment
The risk is unauthorized access to sensitive notebook metadata, potentially revealing information about the structure and content of private organizational notes.
Recommendation
It is recommended to immediately upgrade SiYuan to version 3.7.4 or later and implement access controls at the API level.
Original NVD description (English source)
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.