CVE-2026-73606 — SiYuan before v3.7.4 Information Disclosure via getRefIDs
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthe…
Published: 2026-08-13 · CVSS: 6.9 · CVSS 4.0
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7