SiYuan CVE-2026-73630

The attack requires only unauthenticated network access to the SiYuan instance - no credentials, no session, and no user interaction are needed, consistent with PR:N/UI:N in the CVSS vector. The enumeration component (tier fingerprinting) is effective against any SiYuan deployment with the publishing feature active and network-reachable. The more severe cookie-issuance component is specifically triggered when a target document's access tier is set to hidden or forbidden, because those tiers store an empty string as their password by design; an attacker's empty-password submission inadvertently matches and satisfies the credential check. Exploitation is bounded by the attacker's ability to enumerate or guess valid document identifiers - SiYuan document IDs are not inherently public. Deployments where no documents are assigned to hidden or forbidden tiers are not exposed to the cookie-issuance path, though document enumeration via tier fingerprinting still applies.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) reflects a network-accessible, zero-friction, unauthenticated attack with limited confidentiality impact - an accurate baseline for the enumeration component, but it may understate the unauthorized cookie issuance aspect, which constitutes a functional authorization bypass rather than purely passive disclosure. There is no CISA KEV listing and no EPSS data was provided; no public proof-of-concept code has been identified, suggesting this has not been widely weaponized. SiYuan is a self-hosted niche tool with a relatively small production footprint, which constrains the blast radius of opportunistic scanning. That said, any organization - even a mid-sized municipal IT team in kielce deploying SiYuan internally - that relies on the hidden or forbidden tiers as an actual access control boundary faces a material risk: the cookie-issuance path is not merely informational; it enables content access. Deployments that use SiYuan solely for public documentation with no restricted tiers face limited practical risk, while those actively using hidden/forbidden tiers for confidential material should treat remediation as urgent regardless of the moderate CVSS score.

An unauthenticated attacker with network access to the SiYuan instance iterates over candidate document identifiers, submitting empty-password POST requests to /api/filetree/authFilePublishAccess for each. By comparing the response body text and the presence or absence of a Set-Cookie header, the attacker builds a map of document existence and access tiers. For any document identified as hidden or forbidden, the server's own logic issues a valid publish-auth cookie in the same response, which the attacker immediately presents to access and read the restricted document's content.