Executive brief
SiYuan is a note-taking application that supports publishing notebooks to the web in "publish mode." The vulnerability allows anyone accessing a published SiYuan instance to view the complete private document structure—including notebooks, folders, and document titles—even for documents the owner marked as hidden or password-protected. This exposes sensitive document organization and titles, and enables attackers to obtain document IDs needed for further attacks. The risk is especially high when publish mode has authentication disabled.
Technical details
The vulnerability is a missing authorization check (CWE-862) affecting five filetree endpoints: getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. These endpoints resolve arbitrary document IDs and paths without checking publish-access permissions, despite neighboring handlers (getRecentDocs, getCriteria, getLocalStorage) implementing such filters. The endpoints are reachable by the publish RoleReader token and by anonymous users when Publish.Auth.Enable is false. An attacker can call these endpoints over the network to: (1) map the complete private document tree including notebooks, folders, and document titles for all documents; (2) resolve known or guessed title paths to document IDs, which are required inputs for other block-read endpoints. The vulnerability affects SiYuan versions ≤ v3.7.2, with a patch available in v3.7.4. No user interaction is required; authentication is not necessary when Publish.Auth.Enable is false.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-08-12: disclosed: Original advisory published to GitHub Advisory Database
- 2026-09-04: advisory: Withdrawn as duplicate of GHSA-5w7r-f4cg-rqq7 but maintained for external reference
- 2026-07-24: patched: Patched in v3.7.4 per primary advisory GHSA-5w7r-f4cg-rqq7