CyberRota Analysis
AI-GeneratedAn incorrect authorization vulnerability in SiYuan versions prior to 3.7.4 allows unauthorized access to content marked as forbidden for anonymous users through various reader-facing endpoints. This flaw can lead to sensitive information exposure, as it improperly filters results using the visibility list instead of the disabled list. Organizations using affected versions should prioritize patching to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.