CVE-2026-73607 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments, especially those with sensitive documents, should assess exposure and verify document access controls. They should also review compensating controls for exposed systems and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-73607 is a medium-severity vulnerability in SiYuan's /api/storage/getOutlineStorage endpoint, which lacks authorization checks, potentially allowing unauthorized access to sensitive document outlines.

• Potential unauthorized access to sensitive document outlines
• Possible information disclosure for documents with restricted access
• Need for verification of document access controls and endpoint authorization

Technical summary

The /api/storage/getOutlineStorage endpoint in SiYuan lacks authorization checks, allowing retrieval of outline state for any document, including those forbidden to readers. This vulnerability has a CVSS score of 6.9 and a severity of MEDIUM. The endpoint is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier, it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage and removeOutlineStorage, both carry CheckAdminRole and CheckReadonly. Only the read path is unguarded.

Defensive priority

Defenders should prioritize verifying exposure and assessing document access controls, especially for sensitive documents.

Recommended defensive actions

• Verify exposure by checking if the /api/storage/getOutlineStorage endpoint is accessible without proper authorization
• Assess document access controls, especially for sensitive documents
• Consider implementing additional authorization checks for the /api/storage/getOutlineStorage endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in SiYuan's /api/storage/getOutlineStorage endpoint, which lacks authorization checks. The endpoint returns the stored outline state for any document, including those forbidden to readers. The source item and CVE record provide evidence of the vulnerability's existence and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.