CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.7.3 are susceptible to an information disclosure vulnerability that allows unauthorized users to access rendered content of publish-disabled documents through specific API endpoints. This flaw enables anonymous users or those with publish RoleReader tokens to exploit the system by supplying a heading block ID, potentially exposing sensitive information. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted.