Executive brief
SiYuan's `/api/notebook/getNotebookInfo` API endpoint fails to enforce access controls, allowing readers to retrieve metadata (name, document count, size, timestamps) from notebooks that are deliberately hidden from them. While no actual document content is exposed, this leaks information about the existence and scale of private notebooks, revealing the author's organizational structure and recent activity in restricted areas.
Technical details
The `/api/notebook/getNotebookInfo` endpoint (kernel/api/router.go:123) is gated only by `CheckAuth` middleware with no authorization checks in the handler itself. When given a notebook identifier, it returns `BoxInfo` fields (ID, Name, DocCount, Size, HSize, Mtime, CTime, HMtime, HCtime) for any loaded notebook, including those marked as closed or unpublished. The handler applies no `IsReadOnlyRoleContext`, `publishAccess`, `Visible`, or `Closed` checks. On v3.7.3, readers can obtain hidden notebook IDs by chaining ungated endpoints (`getBlockDefIDsByRefText` → `getPathByID`), though on the development branch those sources are already gated. The vulnerability is classified as authorization bypass / information disclosure; it requires network reachability to the publish API endpoint (port 6808 by default) and either anonymous access or a reader account depending on auth settings.
Affected products
- SiYuan SiYuan < 0.0.0-20260726005141-9edb321eb451; v3.7.3 and v3.7.4-alpha.1
Timeline
- 2026-07-26: disclosed: Published to GitHub Advisory Database
- 2026-09-08: advisory: Advisory published by GitHub
- 2026-07-26: patched: Patched in commit 9edb321eb451
References
- https://api.github.com/users/shirshakopencti
- https://github.com/shirshakopencti
- https://api.github.com/users/shirshakopencti/gists%7B/gist_id%7D
- https://api.github.com/users/shirshakopencti/repos
- https://avatars.githubusercontent.com/u/210834347?v=4
- https://api.github.com/users/shirshakopencti/events%7B/privacy%7D