CVE-2026-73630
Received Received - Intake

SiYuan Information Disclosure via Unauthenticated Filetree Access

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73630
EUVD
EUVD-2026-58620

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.4 has an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint. This endpoint is accessible anonymously despite being registered with CheckAuth. The vulnerability allows an attacker to determine whether a document is public, password-protected, hidden, forbidden, or nonexistent by analyzing response messages and the presence of a Set-Cookie header when submitting requests with an empty password.

Detection Guidance

To detect this vulnerability, test the /api/filetree/authFilePublishAccess endpoint by sending requests with an empty password for document identifiers. Check for differences in response messages and Set-Cookie headers to determine access tiers. Use tools like curl to automate requests and analyze responses for public, password-protected, hidden, or forbidden documents.

Impact Analysis

An attacker can confirm the existence of documents they are not permitted to access. For forbidden documents, the server may issue a publish-auth cookie, enabling further unauthorized actions. While document content is not disclosed, the vulnerability acts as a confirmation primitive to identify restricted documents.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of document existence, potentially violating data confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to unauthorized access confirmation and potential exposure of restricted document identifiers.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to patch the vulnerability. Ensure the /api/filetree/authFilePublishAccess endpoint returns identical failure responses regardless of access tier. Disable anonymous access to sensitive endpoints if possible and monitor for unauthorized cookie issuance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart