Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | 3.7.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 | GHSA-j4ph-9xwf-wcj4 |
References
- GitHub Security Advisory (GHSA-j4ph-9xwf-wcj4) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels third-party-advisory