CVE-2026-73607 in SiYuan
Summary
by MITRE • 08/13/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within the SiYuan note-taking application where version 3.7.4 and earlier contain a critical information disclosure flaw in the /api/storage/getOutlineStorage endpoint. The vulnerability stems from the absence of proper authorization controls that should verify user permissions before exposing document outline data. This endpoint is designed to return structured outline information including heading identifiers for documents, but fails to validate whether the requesting user has legitimate access rights to the specified document. The flaw allows any authenticated or unauthenticated attacker to exploit this API endpoint by simply providing a valid document identifier, thereby bypassing all access control mechanisms that should normally restrict such data retrieval operations.
The technical nature of this vulnerability aligns with CWE-284, which describes improper access control where an application fails to properly enforce access restrictions on resources. This specific implementation represents a privilege escalation scenario where unauthorized users can obtain sensitive document structure information without proper authorization. The operational impact extends beyond simple information disclosure as attackers can gather detailed outline data including hierarchical heading identifiers, potentially enabling them to reconstruct document structures and content organization patterns for malicious purposes. This metadata exposure could facilitate more sophisticated attacks such as targeted social engineering campaigns or assist in planning further exploitation attempts against the document repository.
The vulnerability creates a significant risk for users who rely on SiYuan for sensitive documentation storage and collaborative work environments. Attackers can systematically enumerate documents by exploiting this endpoint, potentially discovering confidential information about document contents, organizational structure, and content hierarchy without proper authorization. This type of information disclosure represents a violation of the principle of least privilege and undermines the security model that should protect user data access. The attack surface is particularly concerning in enterprise environments where SiYuan might be used for storing proprietary information, internal documentation, or sensitive project details.
Mitigation strategies should focus on implementing robust authorization checks at the API endpoint level, ensuring that each request to retrieve outline storage data must be validated against the requesting user's permissions and access rights. The system should enforce proper authentication mechanisms and maintain detailed access logs for monitoring unauthorized attempts to retrieve document outlines. Security patches should include mandatory permission verification before any document metadata retrieval occurs, with appropriate error handling for unauthorized access attempts. Organizations should also consider implementing additional security controls such as rate limiting on API endpoints to prevent systematic enumeration attacks, while ensuring that all user sessions maintain proper session management and authentication tokens are properly validated.
From an ATT&CK framework perspective, this vulnerability maps to technique T1071.004 for Application Layer Protocol: DNS and technique T1566 for credential access through unauthorized data access. The vulnerability enables adversaries to gather intelligence about document structures and organizational content patterns, which could be leveraged for more targeted attacks or for understanding the security landscape of the affected environment. Regular security assessments should include testing for similar authorization bypass vulnerabilities in web applications, particularly those involving document management systems where metadata exposure could provide significant operational value to attackers.