CVE-2026-73609
Received Received - Intake

SiYuan Information Disclosure via Bookmark Labels

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73609
EUVD
EUVD-2026-57813

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73609 is an information disclosure vulnerability in SiYuan versions before v3.7.4. The getBookmarkLabels endpoint returns all bookmark labels in a workspace without proper authorization checks. Anonymous readers and publish-mode users can access the complete bookmark vocabulary, including sensitive organizational details from otherwise restricted documents.

Detection Guidance

Check if your SiYuan instance is running a version before v3.7.4. Inspect network traffic for requests to the /api/attr/getBookmarkLabels endpoint. Use curl to test the endpoint: curl -X POST http://<target-ip>:<port>/api/attr/getBookmarkLabels -H 'Content-Type: application/json' -d '{}' and verify if it returns bookmark labels from restricted documents.

Impact Analysis

This vulnerability allows unauthorized users to view all bookmark labels in a workspace, exposing sensitive information such as project names, personal details, and organizational structure. Even documents marked as hidden or password-protected may have their bookmark labels disclosed.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal or sensitive data without authorization. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized disclosure violates these regulations.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later immediately. If upgrading is not possible, restrict access to the /api/attr/getBookmarkLabels endpoint via network firewall rules or disable anonymous access. Review all exposed bookmark labels for sensitive data leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart