Is CVE-2026-73049 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73049 being exploited in the wild.

How severe is CVE-2026-73049?

Medium severity, with a CVSS score of 5.8, published 23 October 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260730150429-5b42614311b0, SEMVER:introduced=0,fixed=0.0.0-20260730150429-5b42614311b0.

How is CVE-2026-73049 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73049?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73049: SiYuan database backlink information disclosure via publish filter

Q: Is there a fix for CVE-2026-73049?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260730150429-5b42614311b0 or later. Until then: Until patched, restrict the `/api/av/getAttributeViewBacklinks` endpoint to authenticated users with appropriate permissions, or disable publish mode if the visibility of hidden documents is critical. [{"kind": "disclosed", "at": "2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-73049 · Severity: medium · CVSS 5.8 · Published 2026-10-23

SiYuan is a knowledge management platform that allows publishing documents with access controls including a "hidden" tier meant to prevent public discovery. A bug in the attribute view backlinks API incorrectly checks the forbidden list instead of the visibility list, allowing anonymous readers to discover hidden documents and learn their titles, database names, and paths by querying backlinks from publicly visible database rows. This discloses the existence and topics of documents the author intended to keep private.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-73049 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73049 being exploited in the wild.
How severe is CVE-2026-73049?: Medium severity, with a CVSS score of 5.8, published 23 October 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260730150429-5b42614311b0, SEMVER:introduced=0,fixed=0.0.0-20260730150429-5b42614311b0.
Is there a fix for CVE-2026-73049?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260730150429-5b42614311b0 or later. Until then: Until patched, restrict the `/api/av/getAttributeViewBacklinks` endpoint to authenticated users with appropriate permissions, or disable publish mode if the visibility of hidden documents is critical.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73049 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73049?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260730150429-5b42614311b0 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260730150429-5b42614311b0
```

Until patched, restrict the `/api/av/getAttributeViewBacklinks` endpoint to authenticated users with appropriate permissions, or disable publish mode if the visibility of hidden documents is critical.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}]

Technical details

The `/api/av/getAttributeViewBacklinks` endpoint filters results using `FilterAttributeViewBacklinksByPublishAccess`, which calls `GetDisablePublishAccess` to build an ignore list. This function only returns documents at the forbidden tier (disable:true), missing hidden-tier documents (visible:false, no password). As a result, hidden documents bypass the access check and are returned to unauthenticated callers. The password-protected and private tiers are correctly enforced by separate checks in the same function, indicating a logic error on a single line rather than a systemic issue.

Affected products

SiYuan SiYuan

Identifiers

CVE-2026-73049
GHSA-p4qw-vx5p-g984
GO-2026-6833

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.