CVE-2026-73049
Received Received - Intake

SiYuan Information Disclosure via Backlink Endpoint

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73049
EUVD
EUVD-2026-58618

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73049 is an information disclosure vulnerability in SiYuan note-taking app versions before v3.7.4. It affects the getAttributeViewBacklinks endpoint, which incorrectly uses a forbidden access list instead of a visibility list when filtering backlinks. This allows anonymous users to query public database rows and receive details about hidden-tier documents that reference them, including database names, row titles, and document paths.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before 3.7.4. Use the endpoint /api/av/getAttributeViewBacklinks with a public row identifier and verify if hidden document metadata (database name, row title, document path) is returned. This indicates exposure of hidden-tier documents.

Impact Analysis

This vulnerability could expose sensitive information stored in hidden-tier documents. An attacker only needs a public row identifier to discover hidden documents that reference it. The disclosed data may include document paths and titles that reveal confidential or proprietary information, potentially leading to privacy breaches or unauthorized access to restricted content.

Compliance Impact

This vulnerability could violate compliance with regulations like GDPR and HIPAA by exposing sensitive or personal data stored in hidden documents. Unauthorized disclosure of such data may result in legal penalties, loss of trust, and failure to meet data protection requirements that mandate strict access controls and confidentiality.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to address the vulnerability. If immediate upgrade is not possible, restrict network access to the /api/av/getAttributeViewBacklinks endpoint and monitor for suspicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart