Executive brief
SiYuan is a note-taking and document management application. A flaw in the local storage API endpoint allows unauthenticated users and read-only visitors to retrieve sensitive administrator data including closed-tab history, search queries, private document identifiers, and folder paths—information that should only be accessible to administrators. An attacker can call a single API endpoint to exfiltrate this data without authentication.
Technical details
The vulnerability is an improper authorization/filtering flaw in three API endpoints (/api/storage/getLocalStorage, getLocalStorageVal, getLocalStorageVals) in the kernel/api/router.go. These endpoints read the administrator's local.json storage file via model.GetLocalStorage() and apply FilterLocalStorageByPublishAccess for non-admin roles. However, the filter function implements a broken allowlist-as-blocklist approach: it returns the entire administrator storage map and removes only three specific keys, leaving approximately 27 keys unfiltered. This includes local-closed-tabs (serialized tab objects with document titles and IDs), local-searchdata (search keywords and scope paths), local-filespaths (expanded private notebook/folder paths), and several other keys keyed by document identifiers. Unauthenticated POST requests or requests with a publish RoleReader token can trigger this disclosure. The filter also cannot validate password-protected publish tiers because it does not receive the request context. Fix: upgrade to v3.7.4 or later.
Affected products
- SiYuan SiYuan before 3.7.4
Timeline
- 2026-07-29: disclosed
- 2026-08-13: advisory
- 2026: patched: Fixed in v3.7.4