Executive brief
SiYuan is a personal knowledge management application that stores notebooks with varying access levels. The /api/notebook/getNotebookInfo endpoint fails to enforce authorization checks, allowing unauthorized users to retrieve metadata (names, document counts, file sizes, timestamps) for closed or non-published notebooks that should be hidden from readers. This leaks information about workspace contents that authors intended to keep private.
Technical details
The /api/notebook/getNotebookInfo endpoint in SiYuan's kernel applies CheckAuth middleware only and performs no authorization filtering. Given a notebook identifier, it returns the notebook's name, document count, total size, and creation/modification timestamps via GetInfo() without checking whether the requester has read access. The endpoint should filter based on publish access and closed status, matching the filtering already performed by the sibling lsNotebooks endpoint. On v3.7.3, attackers can obtain hidden notebook identifiers by chaining getBlockDefIDsByRefText (which returns block IDs workspace-wide) with getPathByID (which resolves to owning notebook IDs). On the development branch, those identifier sources are gated, making this defense-in-depth. The vulnerability affects SiYuan before v3.7.4, with no patched version listed for the withdrawn duplicate advisory (GHSA-mxjf-vfmv-qfm6), though the original advisory (GHSA-74pj-6g7r-j55c) indicates v3.7.4 as patched.
Affected products
- SiYuan SiYuan before 3.7.4
Timeline
- 2026-07-26: disclosed: Original advisory GHSA-74pj-6g7r-j55c published
- 2026-08-12: advisory: Duplicate advisory GHSA-mxjf-vfmv-qfm6 published
- 2026-09-08: other: Duplicate advisory GHSA-mxjf-vfmv-qfm6 withdrawn as duplicate of GHSA-74pj-6g7r-j55c