CVE-2026-73610
Received Received - Intake

SiYuan Information Disclosure via Local Storage Filter

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73610
EUVD
EUVD-2026-57814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.4 has an information disclosure vulnerability in its local storage filter. The getLocalStorage endpoint returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can access closed-tab history, search keywords, private document identifiers, and expanded folder paths.

Detection Guidance

Check if the SiYuan application is running a version before 3.7.4. Inspect network traffic for requests to the /api/storage/getLocalStorage endpoint. Look for unauthorized access attempts or unusual data retrievals from this endpoint.

Impact Analysis

This vulnerability allows unauthorized access to sensitive data such as closed-tab history, search keywords, private document identifiers, and folder paths. Attackers could exploit this to gather confidential information without authentication.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Disable the publish feature if not required. Review and restrict access to the /api/storage/getLocalStorage endpoint. Monitor for any suspicious activity related to local storage access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart