CVE-2026-73609

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the 'getBookmarkLabels' endpoint. The system returns all bookmark labels within the workspace without applying publish-access filtering. This allows anonymous readers and readers in publish-mode to access the complete bookmark vocabulary across the workspace, potentially revealing subject matter and organizational details from documents they are not authorized to access.

Recommendations Update to version 3.7.4 or later. Restrict access to the 'getBookmarkLabels' endpoint as a temporary mitigation measure.