PT-2026-71246 · Siyuan · Siyuan
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.4
Description
An authentication bypass exists where the software fails to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and the complete reference topology by calling the 'getGraph' and 'getLocalGraph' endpoints without providing a password.
Recommendations
Update SiYuan to version 3.7.4 or later.
Fix
Information Disclosure
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siyuan