CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.7.4 are vulnerable to an information disclosure flaw in the getAttributeViewBacklinks endpoint, allowing unauthorized users to access details of hidden documents by supplying a visible database row identifier. This could lead to the exposure of sensitive information, including database names and document paths. Organizations using affected versions should prioritize patching to mitigate potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.