Executive brief
SiYuan is a note-taking application that supports cross-document editing transactions. An authentication bypass vulnerability in the undoState API endpoint allows authenticated readers to discover the internal identifiers of private documents that were modified as part of the same transaction, even when those documents should not be visible to them. While document contents are not exposed, this leaks sensitive metadata about which private documents exist and how they relate to published documents.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the POST /api/transactions/undoState endpoint. The handler checks only that a user is authenticated (CheckAuth) but fails to filter the returned peekMutatedRootIDs list through publish-access visibility controls. A reader who knows the root ID of a visible document can supply it to the endpoint and receive root IDs for all other documents modified in the same cross-document transaction, including private or unpublished documents. The endpoint returns internal identifiers and transaction relationships without applying the same publish-access predicates used by content APIs. The vulnerability affects v3.8.1 and is fixed in v3.8.2; no network authentication bypass is required, only valid reader-level credentials.
Affected products
- SiYuan SiYuan 3.8.1; fixed in 3.8.2
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-6gf8-q9ch-w732 published
- 2026-08-21: patched: Fix released in v3.8.2
- 2026-09-04: advisory: CVE-2026-85579 and NVD entry published