CVE-2026-103762 — SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only p…
Published: 2026-10-02 · CVSS: 6.9 · CVSS 4.0
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7