CVE-2026-73606
MediumCVSS 5.8Summary
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.
Risk Assessment
Unauthorized individuals can obtain information about relationships between password-protected documents and blocks, potentially leading to data confidentiality breaches.
Recommendation
It is recommended to upgrade SiYuan to version v3.7.4 or later, which includes the fix for checking access to password-protected documents in the getRefIDs endpoint.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.