CVE-2026-73630 siyuan-note CVE debrief

Who should care

Organizations and users of SiYuan before version 3.7.4 should be aware of this vulnerability and take steps to mitigate it. This includes applying patches or updates to SiYuan to version 3.7.4 or later, restricting access to the /api/filetree/authFilePublishAccess endpoint, and monitoring for suspicious activity related to the vulnerable endpoint. Security teams and vulnerability management teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, asset inventory and change management processes should be reviewed to ensure that affected systems are identified and remediated promptly. Monitoring and detection capabilities should also be checked for relevant logs and alerts to identify potential exploitation attempts. This vulnerability may impact operators, platforms, and security teams, making it essential to assess and address the risk accordingly. The vulnerability's impact on security posture should be evaluated, and appropriate measures should be taken to minimize potential damage. This includes tracking exceptions, retesting remediated assets, and closing the item only after evidence of successful remediation is documented. Overall, affected organizations should treat this vulnerability with a high priority due to its potential for information disclosure and unauthorized access to sensitive documents. Proactive measures, such as applying patches, enhancing monitoring, and reviewing security controls, are crucial to mitigating the risk associated with CVE-2026-73630. By taking these steps, organizations can reduce the likelihood of exploitation and protect their sensitive information from unauthorized disclosure. Security teams should also consider the potential operational impact of this vulnerability and plan accordingly to minimize disruptions. This may involve coordinating with vendors, implementing compensating controls, and developing incident response plans in case of exploitation. By prioritizing patching and taking proactive measures, organizations can effectively manage the risk associated with CVE-2026-73630 and protect their assets from potential exploitation.

Technical summary

The /api/filetree/authFilePublishAccess endpoint in SiYuan before v3.7.4 is vulnerable to information disclosure. An anonymous attacker can submit requests with an empty password to determine the existence of documents they are not permitted to access. The endpoint never sets a failure code; instead, its outcome is signaled by the response message and the presence of a Set-Cookie header, which differ across access tiers. This allows attackers to distinguish between public, nonexistent, password-protected, or documents stored at hidden or forbidden tiers.

Defensive priority

Organizations using SiYuan should prioritize patching to prevent potential information disclosure.

Recommended defensive actions

• Apply patches or updates to SiYuan to version 3.7.4 or later
• Restrict access to the /api/filetree/authFilePublishAccess endpoint
• Monitor for suspicious activity related to the vulnerable endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-73630 record indicates an information disclosure vulnerability in SiYuan before v3.7.4. The /api/filetree/authFilePublishAccess endpoint is vulnerable, allowing an anonymous attacker to determine the existence of documents they are not permitted to access by submitting requests with an empty password.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.