CVE-2026-73630

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the '/api/filetree/authFilePublishAccess' endpoint, which is accessible anonymously. The endpoint does not return failure codes, instead signaling outcomes through response messages and the presence of a 'Set-Cookie' header. By sending requests with an empty password for a specific document identifier, an attacker can determine if a document is public, nonexistent, password-protected, or located within hidden or forbidden tiers. Additionally, because hidden and forbidden entries use empty passwords, these requests can trigger the server to issue a publish-auth cookie for forbidden documents.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the '/api/filetree/authFilePublishAccess' endpoint.