CVE-2026-74906

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p
https://www.vulncheck.com/advisories/siyuan-before-incorrect-authorization-via-publish-access
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) SiYuan anterior a la v3.7.4 contiene una vulnerabilidad de autorización incorrecta en ocho puntos finales orientados al lector en modo de publicación que filtran los resultados utilizando la lista de visibilidad en lugar de la lista de deshabilitados. Los visitantes anónimos pueden descubrir y leer contenido de documentos explícitamente marcados como prohibidos para su publicación al acceder a los puntos finales de búsqueda, enlaces de retroceso, contenido de activos, criterios guardados, documentos recientes, gráfico y etiquetas.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-74906

Mitre link : CVE-2026-74906

CVE.ORG link : CVE-2026-74906

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-74906", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74906", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T13:50:55.312820Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "0", "lessThan": "3.7.4", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:30.913", "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/siyuan-before-incorrect-authorization-via-publish-access", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints."}, {"lang": "es", "value": "SiYuan anterior a la v3.7.4 contiene una vulnerabilidad de autorizaci\u00f3n incorrecta en ocho puntos finales orientados al lector en modo de publicaci\u00f3n que filtran los resultados utilizando la lista de visibilidad en lugar de la lista de deshabilitados. Los visitantes an\u00f3nimos pueden descubrir y leer contenido de documentos expl\u00edcitamente marcados como prohibidos para su publicaci\u00f3n al acceder a los puntos finales de b\u00fasqueda, enlaces de retroceso, contenido de activos, criterios guardados, documentos recientes, gr\u00e1fico y etiquetas."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}