Medium severity · published Aug 13, 2026
CVE-2026-73607
SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
5.8
CVSS
0.3%
EPSS
No
On KEV
Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73607
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP