CVE-2026-73607

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists where the '/api/storage/getOutlineStorage' endpoint fails to perform authorization checks. This allows an attacker to retrieve the outline state, including heading identifiers, for any document by providing its identifier, regardless of whether the requester has permission to access the document.

Recommendations Update to version 3.7.4 or later. Restrict access to the '/api/storage/getOutlineStorage' endpoint as a temporary mitigation measure.