CVE-2026-73049 in SiYuan
Summary
by MITRE • 08/14/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the SiYuan knowledge management system where version v3.7.4 and earlier contain a critical information disclosure flaw in the getAttributeViewBacklinks endpoint. The core technical issue stems from improper access control implementation where the system incorrectly references the forbidden access list rather than the proper visibility list when filtering backlink results. This fundamental misconfiguration creates a privilege escalation scenario where unauthorized users can exploit the system's access controls to gain knowledge of hidden content that should remain restricted to specific user tiers.
The operational impact of this vulnerability extends beyond simple information disclosure as it enables anonymous attackers to systematically discover and enumerate hidden-tier documents within the database. When an attacker supplies a valid publicly visible database row identifier, the system's flawed filtering mechanism returns metadata including database names, row titles, and document paths of documents that are normally restricted from view. This creates a comprehensive reconnaissance capability where threat actors can map out the entire content structure of a SiYuan instance, identifying sensitive documents and their relationships without proper authentication or authorization.
The vulnerability directly relates to CWE-200, which addresses information exposure, and specifically manifests as an improper access control mechanism that violates fundamental security principles. From an adversarial perspective, this issue aligns with ATT&CK technique T1566 which involves credential access through social engineering and system exploitation. The flaw represents a classic case of insufficient authorization checking where the system's defense-in-depth mechanisms fail to properly validate user permissions before returning sensitive information.
Security implications are particularly severe given that this vulnerability can be exploited by anonymous users without requiring any authentication credentials, making it highly accessible to threat actors. The disclosed information reveals not just individual document locations but also establishes relationships between content items, potentially enabling attackers to construct detailed maps of organizational knowledge structures and identify high-value targets. Organizations using SiYuan versions prior to v3.7.4 face significant risk of data leakage and unauthorized access to sensitive information that should remain protected within restricted access tiers.
The mitigation strategy requires immediate deployment of the patched version v3.7.4 which corrects the access control logic by properly implementing the visibility list filtering mechanism instead of the erroneous forbidden access list check. Additionally, organizations should conduct comprehensive audits of their SiYuan configurations to ensure proper access control policies are enforced and consider implementing additional monitoring for unusual query patterns that might indicate exploitation attempts. System administrators should also review and tighten overall access controls, ensuring that document visibility settings properly restrict unauthorized access while maintaining legitimate user workflows and information sharing requirements.