CVE-2026-73049 · GHSA-p4qw-vx5p-g984

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

Risk score: 50/100
CVSS: 5.8 v3.1
Exploit chance (30 days): 0.3%
Published: 14 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier docume…
Affected: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260730150429-5b42614311b0
Fix: Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260730150429-5b42614311b0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/siyuan-note/siyuan/kernel: Red, act today. SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish …

The flaws

CVE-2026-73049: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers (CVSS 5.8 · EPSS 0%)
CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking (CVSS 10.0 · EPSS 1%)
CVE-2026-73054: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (CVSS 7.5 · EPSS 1%)
GHSA-9cqf-hhrq-7v45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route (CVSS 8.6)

The fix

Upgrade github.com/siyuan-note/siyuan/kernel: 3.7.4 · 3.7.3 or later on your release line

Who is exposed: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260721043339-eef10568384e

Where it stands

Public proof of concept

Connects to

Same weakness: Incorrect authorisation (CWE-863). 335 other warnings in 30 days

Why it is Yellow

CVSS 5.8 medium
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260730150429-5b42614311b0	0.0.0-20260730150429-5b42614311b0

References

Original description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

Last activity 23 Oct 2026. Patch Forecast updates every hour.