CVE-2026-73609
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.
Risk Assessment
Unauthorized individuals can learn the subject matter of documents they do not have access to, potentially leading to confidentiality breaches of organizational information.
Recommendation
It is recommended to upgrade SiYuan to version v3.7.4 or later, which includes the fix for filtering access to bookmark labels.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.