CVE-2026-85579

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description An information disclosure issue exists in the reader-accessible POST '/api/transactions/undoState' endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents, including private or unpublished ones, that were modified in the same cross-document transaction. This discloses internal identifiers and cross-document relationships, although document body contents are not directly exposed.

Recommendations Update to version 3.8.2.