SiYuan CVE-2026-74906

Exploitation requires that the target SiYuan instance has publish mode explicitly enabled and is reachable over the network by the attacker. The authorization flaw exists only in the eight publish-mode reader-facing endpoints; SiYuan installations operating without publish mode are not exposed through this vulnerability. No authentication is required (CVSS PR:N confirmed), and no user interaction is needed. Exploitation is meaningful only when at least one document has been placed on the disabled list - installations where no content has been restricted via the disabled list have no forbidden material to leak. The key limiting factors for defenders are therefore: publish mode must be on, the instance must be network-accessible, and the operator must have used the disabled-list feature to restrict specific documents.

The CVSS 4.0 base score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately reflects the severity: the flaw is trivially exploitable over the network by any unauthenticated party, with no attack complexity and high confidentiality impact against the vulnerable system. Even a mid-sized municipal IT team in kielce running SiYuan as a publish-mode knowledge base accessible from the public internet should treat this as urgent, since the disabled-list mechanism they rely on to protect sensitive content provides no actual protection on any of the eight affected endpoints. No EPSS score was supplied in the input data, and the vulnerability does not appear in the CISA KEV catalog, so active exploitation in the wild is not confirmed. The attack requires no specialized tooling - standard HTTP GET requests to well-known publish API paths suffice - making exploitation highly automatable once endpoint naming conventions are known, which is a meaningful escalation of real-world risk beyond the theoretical CVSS signal. The primary mitigating factor is the deployment precondition: only SiYuan instances running in publish mode with internet exposure are affected, which reduces the exposed population relative to the full install base.

An unauthenticated remote attacker identifies an internet-exposed SiYuan instance running in publish mode by probing known publish-API endpoint paths. The attacker sends a standard HTTP GET request to the search or recent-documents endpoint and receives a response containing notes the operator explicitly marked as forbidden from publishing - potentially revealing private research, internal project documentation, or sensitive personal information embedded in the knowledge graph. No proof-of-concept code is publicly known at time of analysis, but the exploit requires only curl or a browser and knowledge of the SiYuan publish API path structure.