CVE-2026-73048 in SiYuan
Summary
by MITRE • 08/14/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The SiYuan information disclosure vulnerability in versions prior to v3.7.4 represents a critical security flaw within the document annotation system that directly violates fundamental access control principles. This vulnerability exists in the getRefIDsByFileAnnotationID endpoint which is designed to retrieve block identifiers associated with PDF annotations. The flaw stems from insufficient authorization checks that fail to properly validate whether the requesting user has legitimate access rights to the referenced documents. When attackers supply valid annotation identifiers that are visible on published pages, the system indiscriminately returns block identifiers without proper access filtering, effectively bypassing the intended security boundaries that should separate public from restricted content.
The technical implementation of this vulnerability demonstrates a clear failure in input validation and access control enforcement mechanisms. The endpoint processes annotation identifiers without verifying that the requesting user possesses appropriate permissions to access the underlying documents containing those annotations. This architectural weakness creates a pathway for attackers to map citation relationships across different security tiers, essentially allowing them to discover references within password-protected or otherwise restricted documents simply by analyzing publicly available annotation data. The vulnerability is particularly concerning because it operates at the metadata level, exposing structural relationships between documents rather than direct content access.
From an operational impact perspective, this information disclosure vulnerability enables attackers to perform reconnaissance activities that would normally be prevented by proper access controls. The exposure of citation relationships provides attackers with valuable intelligence about document hierarchies and content dependencies, potentially revealing sensitive information about organizational knowledge structures or research projects. This type of metadata leakage can facilitate more sophisticated attacks such as targeted content harvesting, social engineering campaigns, or insider threat exploitation where the mapping of document relationships becomes a critical component of attack planning.
The vulnerability aligns with CWE-200 (Information Disclosure) and represents a specific instance of inadequate access control enforcement that violates security principle of least privilege. From an ATT&CK framework perspective, this vulnerability maps to technique T1566 (Phishing) and T1041 (Exfiltration Over C2 Channel) as attackers can use the extracted information to craft more convincing social engineering attacks or establish more effective data exfiltration pathways. The lack of proper access filtering in the getRefIDsByFileAnnotationID endpoint creates a persistent threat vector that remains active until the underlying software is properly patched.
Effective mitigation strategies must focus on implementing comprehensive access control validation at the endpoint level, ensuring that all annotation-related queries verify both the authenticity of the annotation identifier and the requesting user's authorization to access the corresponding document. The recommended solution involves updating SiYuan to version 3.7.4 or later where proper access filtering has been implemented, along with establishing additional monitoring mechanisms to detect anomalous querying patterns that might indicate exploitation attempts. Organizations should also consider implementing network-level controls to limit access to sensitive endpoints and establish automated alerting for unusual data access patterns that could indicate successful exploitation of this vulnerability.