SiYuan Information Disclosure via Undo State Endpoint

Executive Summary

CVE-2026-85579 is an information disclosure vulnerability in SiYuan note-taking application affecting version 3.8.1. The issue occurs in the POST /api/transactions/undoState endpoint, which returns internal document root IDs from the undo-log stack without proper visibility filtering. An authenticated reader can exploit this by providing a known root ID of a visible document to retrieve root IDs of other documents modified in the same transaction, including private or unpublished ones. This exposes internal identifiers and cross-document relationships but does not directly disclose document content.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running version 3.8.1 or earlier. Verify if the POST /api/transactions/undoState endpoint is accessible and returns additional root IDs beyond expected transaction data. Use network monitoring tools to inspect API responses for unexpected data leaks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with reader privileges to access internal document identifiers and relationships between documents. While document content is not directly exposed, the attacker can learn which documents are linked through transactions, potentially revealing sensitive organizational structures or private document interactions. The impact is limited to information disclosure rather than data modification or deletion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with privacy regulations like GDPR and HIPAA by potentially exposing internal document relationships and identifiers without authorization. While document content is not directly disclosed, the exposure of document metadata and cross-document interactions could violate principles of data minimization and access control, depending on organizational policies and regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SiYuan to version 3.8.2 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/transactions/undoState endpoint or implement visibility filtering to prevent unauthorized access to internal document IDs.

Useful 0 Not Useful 0