CVE-2026-59853

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef31605077d36
https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) SiYuan es un sistema de gestión de conocimiento personal de código abierto. Antes de 3.7.1, el endpoint /API/storage/getCriteria devuelve criterios de búsqueda guardados de data/storage/criteria.json sin el filtrado de acceso de publicación utilizado por los endpoints de almacenamiento hermanos, lo que permite a un Lector en modo de publicación leer rutas de documentos privados, IDs de cuadernos, documentos y bloques, y palabras clave de búsqueda y reemplazo para documentos no publicados. Este problema está solucionado en la versión 3.7.1.

Information

Published : 2026-07-09 23:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-59853

Mitre link : CVE-2026-59853

CVE.ORG link : CVE-2026-59853

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-59853", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59853", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T13:47:32.142690Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.7.1"}]}]}], "published": "2026-07-09T23:17:06.030", "references": [{"url": "https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef31605077d36", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal de c\u00f3digo abierto. Antes de 3.7.1, el endpoint /API/storage/getCriteria devuelve criterios de b\u00fasqueda guardados de data/storage/criteria.json sin el filtrado de acceso de publicaci\u00f3n utilizado por los endpoints de almacenamiento hermanos, lo que permite a un Lector en modo de publicaci\u00f3n leer rutas de documentos privados, IDs de cuadernos, documentos y bloques, y palabras clave de b\u00fasqueda y reemplazo para documentos no publicados. Este problema est\u00e1 solucionado en la versi\u00f3n 3.7.1."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}