Executive brief
SiYuan is a popular open-source note-taking and knowledge management application. A missing authorization check in the encrypted notebook status API endpoint allows anonymous users or unprivileged readers to discover the names and current lock state of all encrypted notebooks on the server—information that should remain private. This defeats the purpose of notebook encryption, since users encrypt notebooks specifically to keep their subject matter confidential.
Technical details
The vulnerable endpoint `POST /api/notebook/getEncryptedNotebookStatus` in `kernel/api/notebook.go` is registered with only `CheckAuth` middleware and lacks the `CheckReadonly` and `CheckAdminRole` checks that guard similar operations. The handler contains no `IsReadOnlyRoleContext` branch and no publish-access filter, returning `{id, name, unlocked}` for all encrypted notebooks unconditionally. This contrasts with the sibling `lsNotebooks` endpoint, which properly filters notebooks based on publish-access visibility. An unauthenticated attacker or read-only account can make a simple POST request to discover all encrypted notebooks and their current lock status, revealing sensitive metadata about the server's private content. The vulnerability is classified as a missing authorization (CWE-862) issue. The patch is available in commit `8fb1b5766093` and later versions.
Affected products
- SiYuan SiYuan < 0.0.0-20260724123622-8fb1b5766093
Timeline
- 2026-09-04: disclosed: Published to GitHub Advisory Database
- 2026-07-24: patched: Patch available in commit 8fb1b5766093