CVE-2026-73607
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
Risk Assessment
Unauthorized individuals can obtain information about the structure of documents they do not have access to, potentially leading to data confidentiality breaches.
Recommendation
It is recommended to upgrade SiYuan to version v3.7.4 or later, which includes the fix adding authorization checks to the getOutlineStorage endpoint.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.