CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.7.4 are vulnerable to an information disclosure flaw in the getBookmarkLabels endpoint, which exposes all bookmark labels in the workspace without proper access controls. This allows unauthorized users, including anonymous and publish-mode readers, to access sensitive organizational information and subject matter from documents they should not be able to see. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.