CVE-2026-85578
Received Received - Intake

SiYuan Authorization Bypass via File Access Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85578
EUVD
EUVD-2026-71001

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan through version 3.8.1 has an authorization bypass vulnerability in the /api/file/getFile endpoint. Users with a reader role can access files from notebooks explicitly marked as private (Visible:false) by knowing the hidden notebook identifier and file path. This allows retrieval of sensitive data like notebook metadata and internal configurations.

Detection Guidance

Check SiYuan server logs for unusual access to the /api/file/getFile endpoint by reader-role users. Monitor for requests containing hidden notebook identifiers or internal file paths like .siyuan/conf.json. Use network traffic analysis tools to inspect HTTP GET requests targeting this endpoint with non-standard parameters.

Impact Analysis

Attackers with reader privileges could access private workspace files, including sensitive documents, notebook metadata, or internal configurations. This could lead to unauthorized data exposure or leakage of confidential information if the notebook was intended to be hidden.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls for sensitive data, such as GDPR or HIPAA. Unauthorized access to private files may result in data breaches, leading to potential legal penalties or loss of trust.

Mitigation Strategies

Immediately restrict reader-role access to the /api/file/getFile endpoint. Disable or remove any notebooks configured with Visible:false if they are not required. Monitor for unauthorized file access attempts and update SiYuan to the latest version once a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart