CVE-2026-73049: SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.4 - Compensating control
Block or restrict external/public access to the SiYuan getAttributeViewBacklinks endpoint until all SiYuan instances are upgraded to v3.7.4 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73049?
The severity of CVE-2026-73049 is classified as medium with a score of 5.8.
How do I fix CVE-2026-73049?
To fix CVE-2026-73049, update SiYuan to version 3.7.4 or later.
What kind of vulnerability is CVE-2026-73049?
CVE-2026-73049 is an information disclosure vulnerability.
Who is affected by CVE-2026-73049?
CVE-2026-73049 affects users of SiYuan versions prior to 3.7.4.
What does CVE-2026-73049 allow an attacker to do?
CVE-2026-73049 allows anonymous users to discover restricted database row identifiers.