cve.bz

CVE-2026-73607

6.9 mediumEPSS 0.3%

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

CVSS 4.0
6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)
CWE
CWE-862
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-53fp-9jmv-227gGogithub.com/siyuan-note/siyuan/kernel<0.0.0-20260812083335-251596fc0de20.0.0-20260812083335-251596fc0de2
GO-2026-6624Gogithub.com/siyuan-note/siyuan/kernel<0.0.0-20260812083335-251596fc0de20.0.0-20260812083335-251596fc0de2

References

Check your stackJSON