CVE-2026-73607 · GHSA-53fp-9jmv-227g

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

Risk score: 50/100
CVSS: 5.8 v3.1
Exploit chance (30 days): 0.3%
Published: 13 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the reques…
Affected: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260812083335-251596fc0de2
Fix: Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/siyuan-note/siyuan/kernel: Red, act today. SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish …

The flaws

CVE-2026-73607: SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check (CVSS 5.8 · EPSS 0%)
CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking (CVSS 10.0 · EPSS 1%)
CVE-2026-73054: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (CVSS 7.5 · EPSS 1%)
GHSA-9cqf-hhrq-7v45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route (CVSS 8.6)

The fix

Upgrade github.com/siyuan-note/siyuan/kernel: 3.7.4 · 3.7.3 or later on your release line

Who is exposed: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260721043339-eef10568384e

Where it stands

Public proof of concept

Connects to

Same weakness: Missing authorisation (CWE-862). 398 other warnings in 30 days

Why it is Yellow

CVSS 5.8 medium
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260812083335-251596fc0de2	0.0.0-20260812083335-251596fc0de2

References

Original description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

Last activity 1 Oct 2026. Patch Forecast updates every hour.