CVE-2026-73048

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

State: Published
Severity: 6.9 Medium
Published: Aug 14, 2026
Updated: Aug 14, 2026
Reserved: Aug 10, 2026

Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N	VulnCheck
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
siyuansiyuan-note	before 3.7.4Affected 3.7.4Not affected

References

GitHub Security Advisory (GHSA-f3q6-vc7q-m6h7)vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationIDthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.