Is CVE-2026-73630 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73630 being exploited in the wild.

How severe is CVE-2026-73630?

Medium severity, with a CVSS score of 5.8, published 23 October 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260731093152-c7522b8db586, SEMVER:introduced=0,fixed=0.0.0-20260731093152-c7522b8db586.

How is CVE-2026-73630 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73630?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73630: SiYuan authFilePublishAccess information disclosure

Q: Is there a fix for CVE-2026-73630?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260731093152-c7522b8db586 or later. Until then: Disable publish mode if it is not required. Additionally, implement rate limiting on the `/api/filetree/authFilePublishAccess` endpoint to increase the cost of enumeration attacks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73630 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-73630?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73630 · Severity: medium · CVSS 5.8 · Published 2026-10-23

SiYuan is a personal knowledge base and publishing platform. An anonymous attacker can send specially crafted requests to determine whether specific documents exist and what their access tier is (hidden, forbidden, password-protected, or public), revealing information about documents the attacker should not be able to see. While no document content is leaked and no accounts are compromised, this breaks the confidentiality of the document structure.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-73630 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73630 being exploited in the wild.
How severe is CVE-2026-73630?: Medium severity, with a CVSS score of 5.8, published 23 October 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260731093152-c7522b8db586, SEMVER:introduced=0,fixed=0.0.0-20260731093152-c7522b8db586.
Is there a fix for CVE-2026-73630?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260731093152-c7522b8db586 or later. Until then: Disable publish mode if it is not required. Additionally, implement rate limiting on the `/api/filetree/authFilePublishAccess` endpoint to increase the cost of enumeration attacks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73630 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73630?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260731093152-c7522b8db586 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260731093152-c7522b8db586
```

Disable publish mode if it is not required. Additionally, implement rate limiting on the `/api/filetree/authFilePublishAccess` endpoint to increase the cost of enumeration attacks.

Technical details

The `/api/filetree/authFilePublishAccess` endpoint returns distinguishable responses based on document access tier: hidden and forbidden documents incorrectly return a `Set-Cookie` header when queried with an empty password (since their stored password is empty), while public and nonexistent documents do not. An anonymous attacker can exploit this difference to enumerate and classify document identifiers. The vulnerability requires publish mode to be enabled and is reachable without authentication.

Affected products

SiYuan SiYuan

Identifiers

CVE-2026-73630
GHSA-4pjg-x8qj-33j5
GO-2026-6828

Timeline

2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.