CVE-2026-73609 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan installations, particularly those with anonymous reader access enabled, should assess the potential impact of this vulnerability and implement necessary mitigations.

Why it matters

CVE-2026-73609 allows anonymous readers to access every bookmark label in a SiYuan workspace, potentially disclosing sensitive information. Defenders should verify exposure, assess impact, and implement necessary mitigations.

• Information disclosure via `/api/attr/getBookmarkLabels` endpoint
• Potential exposure of sensitive bookmark labels to anonymous readers
• Need for filtering or authentication to access bookmark labels
• Verification of SiYuan installation exposure and impact

Technical summary

The `/api/attr/getBookmarkLabels` endpoint in SiYuan is vulnerable to information disclosure, allowing anonymous readers to access every bookmark label in the workspace without publish-access filtering. This issue arises from the endpoint's lack of publish-access filtering, making it accessible to anonymous readers when `Publish.Auth.Enable` is `false`. The adjacent endpoint that returns bookmarks with their blocks does filter, but the `/api/attr/getBookmarkLabels` endpoint does not, leading to potential information disclosure.

Defensive priority

Defenders should prioritize verifying the exposure of SiYuan installations to anonymous readers and assessing the potential impact of information disclosure via the `/api/attr/getBookmarkLabels` endpoint.

Recommended defensive actions

• Verify the exposure of SiYuan installations to anonymous readers
• Assess the potential impact of information disclosure via the `/api/attr/getBookmarkLabels` endpoint
• Implement filtering or authentication for access to bookmark labels
• Monitor for potential exploitation of the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability in SiYuan's `/api/attr/getBookmarkLabels` endpoint, which returns every bookmark label in the workspace to anonymous readers without publish-access filtering.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.