CVE-2026-103762

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5

Description Missing authorization in the 'getRefCreateSavePath', 'getShorthandSavePath', and 'getDocCreateSavePath' endpoints allows users with read-only or anonymous publish access to obtain unpublished notebook box IDs. By sending a POST request with an open notebook ID, an attacker can retrieve the global save-box ID and save-path template, which reveals the creation time and existence of hidden notebooks.

Recommendations Update to version 3.8.5 or later.