CVE-2026-103763 — SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebo…
Published: 2026-10-02 · CVSS: 6.9 · CVSS 4.0
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7