Vulnerability Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984
- https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-ge
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984
FAQ
What is CVE-2026-73049?
CVE-2026-73049 is a vulnerability with a CVSS score of 5.8 (MEDIUM). SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filt...
How severe is CVE-2026-73049?
CVE-2026-73049 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73049?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.