{"uuid": "6a008d41-bae6-4c78-a154-6e382a2c79ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73607", "type": "seen", "source": "https://gist.github.com/alon710/d5fa4fcd1dad3964c1d3e73bdba0732b", "content": "# CVE-2026-73607: CVE-2026-73607: Missing Authorization in SiYuan /api/storage/getOutlineStorage Leads to Information Disclosure\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73607\n\n## Summary\nAn architectural evaluation of CVE-2026-73607 in the SiYuan personal knowledge management system. This technical advisory details a Missing Authorization (CWE-862) vulnerability in the Go-based backend kernel, specifically within the outline storage API endpoint. Under certain configurations, authenticated low-privilege users can query metadata, heading structures, and block hierarchies of restricted documents.\n\n## TL;DR\nA Broken Object Level Authorization (BOLA) vulnerability in SiYuan prior to v3.7.4 allows authenticated users to extract document outlines and structural metadata of unauthorized notes via the `/api/storage/getOutlineStorage` API endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 / v4.0**: 5.8 (Medium) / 6.9 (Medium)\n- **EPSS Score**: 0.00325 (Percentile: 23.20%)\n- **Impact**: Information Disclosure (Confidentiality: Low)\n- **Exploit Status**: PoC Available / No Active Exploitation\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: >= 0, < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to v3.7.4 or later\n- Implement network-level segmentation to restrict API access\n- Restrict user creation and guest access on server-mode instances\n\n**Remediation Steps:**\n1. Verify the currently running version of the SiYuan kernel by inspecting the application logs or interface settings.\n2. Download the latest stable release (v3.8.0 or newer) from the official repository.\n3. Replace the old executable or container image with the updated version.\n4. Restart the SiYuan service and monitor authentication logs for standard API requests.\n\n## References\n\n- [GitHub Security Advisory (GHSA-53fp-9jmv-227g)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-73607)\n- [Official Patch Release Tag (v3.8.0)](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73607) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T21:30:31.000000Z"}