Information Disclosure Vulnerability in SiYuan by SiYuan

CVE-2026-103763

What is CVE-2026-103763?

SiYuan versions prior to 3.8.5 are susceptible to an information disclosure vulnerability. This flaw enables individuals with read-only access to gain insight into metadata related to documents that are intended to be hidden from unauthorized viewers. By exploiting the getNotebookInfo endpoint, attackers—including anonymous users when no password is set—can query notebooks that are visible for publishing. They can potentially retrieve sensitive information such as the count, size, and modification timestamps of documents that have been excluded from public access. This represents a significant privacy concern for users relying on SiYuan to manage their documents securely.

References