CVE-2026-73606

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the '/api/block/getRefIDs' endpoint due to a failure to verify password-protected document tiers. This allows unauthenticated readers to identify that password-protected documents reference specific blocks and retrieve block identifiers without providing the required document password.

Recommendations Update to version 3.7.4 or later. Restrict access to the '/api/block/getRefIDs' endpoint as a temporary mitigation measure.