CVE-2026-72808

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the '/api/asset/getFileAnnotation' endpoint. The endpoint returns .sya PDF-annotation file content without performing a publish-access check, as it is only gated by CheckAuth. This allows an anonymous reader, when publish authentication is disabled, or any RoleReader with knowledge of an asset path to access private PDF annotations, such as highlights and notes, from documents that are unpublished, password-protected, or forbidden from publishing. This issue only affects non-encrypted notebooks, as encrypted-box annotations remain protected.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the '/api/asset/getFileAnnotation' endpoint.