Executive brief
SiYuan is a personal knowledge management system that stores document outlines (heading hierarchies). An unauthenticated attacker can retrieve outline metadata including heading identifiers for any document by querying the /api/storage/getOutlineStorage endpoint, even for documents marked as forbidden or otherwise restricted. This leaks structural information about private documents and reveals which documents administrators have viewed.
Technical details
The /api/storage/getOutlineStorage endpoint implements only basic authentication checks (CheckAuth) but performs no authorization verification to confirm whether the requester has access to the requested document. The vulnerable handler accepts a document identifier, queries the outline storage directly via model.GetOutlineStorage(docID), and returns the stored outline state (expanded heading block IDs) without checking the document's publish access tier or visibility rules. In contrast, the write endpoints (setOutlineStorage, removeOutlineStorage) enforce additional guards including CheckAdminRole and CheckReadonly. An unauthenticated user in publish mode, or any reader with limited permissions, can extract heading identifiers and determine whether administrators have interacted with forbidden documents. The vulnerability was patched in v3.7.4 by adding proper authorization checks to the read path.
Affected products
- SiYuan SiYuan before 3.7.4
Timeline
- 2026-07-29: disclosed: GitHub Security Advisory GHSA-53fp-9jmv-227g published
- 2026-08-13: patched: Fix released in v3.7.4