CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to exploit the POST /api/transactions/undoState endpoint in SiYuan v3.8.1, enabling them to access internal root IDs of documents modified in the same transaction without proper visibility filtering. This could lead to the disclosure of internal identifiers and relationships between documents, potentially exposing sensitive information about unpublished or private documents. Organizations using SiYuan, particularly those handling sensitive data, should prioritize updating to version 3.8.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.