SiYuan EUVD-2026-91419

Requires a SiYuan instance with the Publish feature enabled and reachable by the attacker; the attacker needs only read-only or anonymous publish-visitor access (no account), and must know or guess open notebook IDs to POST to the three save-path resolver endpoints. Exploitation is limited to instances that actually expose publishing to untrusted networks - a SiYuan install used purely locally or without the publish server exposed is not affected. Impact is further constrained to metadata leakage (notebook box IDs, existence, creation time) and does not disclose note contents, modify data, or affect availability.

This is a medium-severity information-disclosure issue that should be triaged below the typical CRITICAL/HIGH queue despite its network-reachable, no-auth, no-interaction profile. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 but the impact set is the key limiter: VC:L with VI:N and VA:N means the only consequence is limited confidentiality - exposure of unpublished notebook box IDs, their existence, and creation timestamps - with no integrity, availability, or content-read impact. No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this should not be treated as an urgent in-the-wild threat. The classification tag 'Authentication Bypass' overstates the issue: CWE-862 and the description both frame it as missing authorization (a broken access-control check), not a credential/authentication bypass - the signals are mildly conflicting and the CWE/description should be treated as authoritative. Real priority is low-to-moderate: patch in routine cycles, prioritizing instances that expose the publish feature publicly.

An attacker visits a publicly shared SiYuan publish site as an anonymous or read-only visitor and sends crafted POST requests to the getRefCreateSavePath/getShorthandSavePath/getDocCreateSavePath endpoints, supplying open notebook IDs. The server returns the global save-box ID and save-path template, letting the attacker enumerate the existence and creation time of notebooks that were never published. No public exploit code is identified at time of analysis; exploitation requires only standard HTTP requests given the low attack complexity.