CVE-2026-74906
Received Received - Intake

SiYuan Improper Authorization in Publish Mode Endpoints

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74906
EUVD
EUVD-2026-60587

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.4 has an incorrect authorization vulnerability in eight publish-mode endpoints. These endpoints filter results using a visibility list instead of a disabled list, allowing anonymous visitors to access content explicitly marked as forbidden from publishing. The affected endpoints include search, backlink, asset content, saved criteria, recent documents, graph, and tag.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running version 3.7.4 or later. If not, inspect network traffic for unauthorized access to endpoints like /api/search, /api/backlink, /api/asset, /api/saved-criteria, /api/recent-docs, /api/graph, and /api/tag. Look for requests from anonymous users accessing content marked as forbidden.

Impact Analysis

This vulnerability allows unauthenticated users to discover and read restricted content through multiple features of the published site. Sensitive or confidential information marked as forbidden from publishing could be exposed to unauthorized individuals.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive or restricted content through multiple features of the published site. For GDPR, this may violate principles of data protection by design and default, potentially resulting in unauthorized access to personal data. For HIPAA, it could expose protected health information if such data was stored in the affected documents.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. If upgrading is not possible, restrict access to the vulnerable endpoints by configuring firewalls or reverse proxies to block unauthorized requests. Review logs for any signs of exploitation and remove any exposed sensitive content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart