{"id":"CVE-2026-73607","kind":"vulnerability","aliases":["CVE-2026-73607","GHSA-53fp-9jmv-227g","GO-2026-6624"],"related":[],"title":"SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.","summary":"SiYuan's /api/storage/getOutlineStorage endpoint returns outline state, including heading IDs, for any document when given its ID, with no access check. An attacker can read outline structure of documents they are not allowed to open.","severity":"medium","cvss":6.9,"epss":0.00325,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260812083335-251596fc0de2"],"affected":"< 0.0.0-20260812083335-251596fc0de2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","siyuan"],"not_affected_if":["managed-hosting","version-3.7.4-or-later"],"how_to_check":"Check the SiYuan kernel version in use; affected if older than v3.7.4 (Go module pseudo-version 0.0.0-20260812083335-251596fc0de2 is the fix).","fix":"Upgrade SiYuan to v3.7.4 or later (Go module github.com/siyuan-note/siyuan/kernel at 0.0.0-20260812083335-251596fc0de2 or later).","status":"open","published_at":"2026-08-13T12:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:00+00:00","updated_at":"2026-10-23T21:46:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:46:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade SiYuan to v3.7.4 or later (Go module github.com/siyuan-note/siyuan/kernel at 0.0.0-20260812083335-251596fc0de2 or later).\nunknown","reach":"network","impact":"low","summary":"SiYuan's /api/storage/getOutlineStorage endpoint returns outline state, including heading IDs, for any document when given its ID, with no access check. An attacker can read outline structure of documents they are not allowed to open.","category":"package","who_cares":["siyuan","self-hosted","go"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads heading structure of documents they cannot access.","analyst_note":"","how_to_check":"Check the SiYuan kernel version in use; affected if older than v3.7.4 (Go module pseudo-version 0.0.0-20260812083335-251596fc0de2 is the fix).\nunknown","needs_analyst":false,"not_affected_if":["managed-hosting","version-3.7.4-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000499,"input_tokens":2984,"output_tokens":401,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':25A,33A,36A '-6624':34A '-73607':26A,37A '/api/storage/getoutlinestorage':15A,49B,93C '/siyuan-note/siyuan/kernel':23A,40A '227g':31A '53fp':29A '9jmv':30A 'access':18A,66B 'allow':79B 'attack':69B,100C 'author':98C 'check':19A,67B,99C 'contain':86C 'cve':24A,35A 'disclosur':89C 'document':6A,8A,59B,75B,110C,117C 'endpoint':50B,94C 'even':115C 'forbidden':9A,118C 'ghsa':28A 'ghsa-53fp-9jmv-227g':27A 'github.com':22A,39A 'github.com/siyuan-note/siyuan/kernel':21A,38A 'given':61B 'go':32A,41B 'head':55B,106C 'host':45B 'id':56B,63B 'identifi':107C,114C 'includ':7A,54B,105C 'inform':88C 'open':81B 'outlin':2A,52B,72B,103C 'packag':42B 'perform':96C 'read':71B 'reader':11A 'request':121C 'retriev':102C 'return':13A,51B 'self':44B 'self-host':43B 'siyuan':1A,46B,47B,82C 'state':3A,53B,104C 'structur':73B 'suppli':112C 'v3.7.4':85C 'version':83C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-13T12:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6624","url":"https://pkg.go.dev/vuln/GO-2026-6624","severity":null,"published_at":"2026-10-07T14:09:59+00:00","modified_at":"2026-10-07T14:09:59+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-73607","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73607","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-73607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73607","severity":null,"published_at":"2026-08-13T12:17:25+00:00","modified_at":"2026-10-23T18:10:00+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}