Live › vulnerability › CVE-2026-73609
Go to dashboardSiYuan's getBookmarkLabels endpoint returns every bookmark label in the workspace, ignoring publish-access limits. An anonymous or publish-mode reader can read the full bookmark vocabulary, which reveals topics and organizational details from documents they cannot open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
Unknown from the sources.
Upgrade the github.com/siyuan-note/siyuan/kernel module to 0.0.0-20260812083335-251596fc0de2 or later (SiYuan v3.7.4 or later per the advisory).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.
This page as .md · .json · in your agent: get_signal("CVE-2026-73609")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.