CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Access
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 18, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 17, 2026
Description
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
siyuansiyuan-note |
|
References
- GitHub Security Advisory (GHSA-48p5-pffc-5r9p)vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Incorrect Authorization via Publish Accessthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.