Live › vulnerability › CVE-2026-73607
Go to dashboardSiYuan's /api/storage/getOutlineStorage endpoint returns outline state, including heading IDs, for any document when given its ID, with no access check. An attacker can read outline structure of documents they are not allowed to open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
Check the SiYuan kernel version in use; affected if older than v3.7.4 (Go module pseudo-version 0.0.0-20260812083335-251596fc0de2 is the fix).
Upgrade SiYuan to v3.7.4 or later (Go module github.com/siyuan-note/siyuan/kernel at 0.0.0-20260812083335-251596fc0de2 or later).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
This page as .md · .json · in your agent: get_signal("CVE-2026-73607")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.