---
id: "CVE-2026-73607"
kind: "vulnerability"
aliases: ["CVE-2026-73607", "GHSA-53fp-9jmv-227g", "GO-2026-6624"]
title: "SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel"
severity: "medium"
cvss: 6.9
epss: 0.00325
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["0.0.0-20260812083335-251596fc0de2"], "affected": "< 0.0.0-20260812083335-251596fc0de2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "self-hosted", "siyuan"]
not_affected_if: ["managed-hosting", "version-3.7.4-or-later"]
published_at: "2026-08-13T12:17:25+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:00+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6624", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-73607", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73607", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel

SiYuan's /api/storage/getOutlineStorage endpoint returns outline state, including heading IDs, for any document when given its ID, with no access check. An attacker can read outline structure of documents they are not allowed to open.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 0.0.0-20260812083335-251596fc0de2 fixed 0.0.0-20260812083335-251596fc0de2

## How to check

Check the SiYuan kernel version in use; affected if older than v3.7.4 (Go module pseudo-version 0.0.0-20260812083335-251596fc0de2 is the fix).

## Fix

Upgrade SiYuan to v3.7.4 or later (Go module github.com/siyuan-note/siyuan/kernel at 0.0.0-20260812083335-251596fc0de2 or later).

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6624
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-73607
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73607

## From the sources

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_