Is CVE-2026-73609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73609 being exploited in the wild.

How severe is CVE-2026-73609?

Medium severity, with a CVSS score of 5.8, published 13 August 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260812083335-251596fc0de2, SEMVER:introduced=0,fixed=0.0.0-20260812083335-251596fc0de2.

Is there a fix for CVE-2026-73609?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73609 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73609?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73609: SiYuan getBookmarkLabels information disclosure

Q: Is there a fix for CVE-2026-73609?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73609 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-73609?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73609 · Severity: medium · CVSS 5.8 · Published 2026-08-13

SiYuan is a popular note-taking and knowledge-management application. The getBookmarkLabels API endpoint fails to filter bookmark labels by access permissions, allowing anonymous and read-only users to obtain a complete list of all bookmark labels across the entire workspace. This leaks information about document contents and organizational structure that the user should not have access to, including details from password-protected, hidden, or restricted documents.

Technologies: github.com/siyuan-note/siyuan/kernel (Go). Vendors: Go.

Quick answers

Is CVE-2026-73609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73609 being exploited in the wild.
How severe is CVE-2026-73609?: Medium severity, with a CVSS score of 5.8, published 13 August 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260812083335-251596fc0de2, SEMVER:introduced=0,fixed=0.0.0-20260812083335-251596fc0de2.
Is there a fix for CVE-2026-73609?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73609 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73609?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260812083335-251596fc0de2
```

Technical details

The vulnerability is a missing authorization / access control flaw in the /api/attr/getBookmarkLabels endpoint. The handler is registered with CheckAuth only and applies no filtering based on publish-access permissions. It performs an unrestricted query of the entire blocks table and returns all distinct bookmark labels in the workspace. In contrast, the sibling getBookmark endpoint correctly filters results using FilterBlocksByPublishAccess and omits labels entirely when no accessible block carries them. The vulnerable endpoint is reachable by anonymous users in publish mode (when Publish.Auth.Enable is false) and by any publish RoleReader token. The fix is to apply the same access-filtering logic as the getBookmark endpoint, ensuring labels are only returned for blocks the caller has permission to access.

Affected products

SiYuan Note SiYuan before v3.7.4

Identifiers

CVE-2026-73609
GHSA-j4ph-9xwf-wcj4
GO-2026-6634

Timeline

2026-07-29: disclosed: GitHub Security Advisory GHSA-j4ph-9xwf-wcj4 published
2026-08-13: patched: Fix released in v3.7.4
2026-08-13: advisory: CVE-2026-73609 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.