Information Disclosure Vulnerability in SiYuan Product by SiYuan Note

CVE-2026-73049

What is CVE-2026-73049?

Versions of SiYuan prior to v3.7.4 are susceptible to an information disclosure issue. The vulnerability occurs in the getAttributeViewBacklinks endpoint, which incorrectly references the forbidden access list rather than the intended visibility list when filtering backlinks. This flaw allows unauthorized, anonymous users to input a publicly accessible database row identifier to uncover hidden documents linked to it. As a result, these users can obtain sensitive information such as the database name, row title, and document path of documents that are not meant to be visible.

References