EUVD-2026-57450
GHSA-74pj-6g7r-j55c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires no authentication or complexity; only limited metadata confidentiality is impacted with no integrity, availability, or scope-change effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.
AnalysisAI
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes notebook metadata - including names, document counts, storage sizes, and timestamps - for closed and non-published notebooks via the /api/notebook/getNotebookInfo endpoint, which performs no authorization check. Any attacker with network access to the SiYuan API can enumerate structural information that the application's access control model explicitly intends to hide from readers. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-friction, unauthenticated attack path makes this trivially exploitable wherever the API is internet- or network-exposed.
Technical ContextAI
SiYuan is a self-hosted, open-source personal knowledge management and note-taking platform (CPE: cpe:2.3:a:siyuan-note:siyuan). Its internal REST API exposes notebook management operations, including the /api/notebook/getNotebookInfo handler responsible for returning notebook metadata. The root cause is CWE-862 (Missing Authorization): the handler returns sensitive metadata to any caller without verifying session tokens, API keys, or other access controls. This is particularly significant because SiYuan implements a notebook visibility model - notebooks can be marked as closed or non-published to restrict reader access - yet the missing authorization check completely bypasses this model, making the endpoint a direct policy violation rather than a simple misconfiguration.
RemediationAI
Upgrade SiYuan to v3.7.4 or later, the vendor-released patch that introduces authorization checks on the /api/notebook/getNotebookInfo endpoint, as detailed in the GitHub Security Advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c. If an immediate upgrade is operationally infeasible, restrict network access to the SiYuan API port using host-based firewall rules or a reverse proxy configured to enforce authentication before proxying requests - this eliminates unauthenticated remote access entirely but introduces a dependency on correct proxy configuration and may break API clients that rely on direct access. Additionally, if SiYuan is not required to be network-accessible, binding the service exclusively to localhost is a highly effective compensating control with no functional impact to local users.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today