CVE-2026-73607 — SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can…
Published: 2026-08-13 · CVSS: 6.9 · CVSS 4.0
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7