CVE-2026-73609: SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Compensating control
Ensure bookmark label access is restricted to publish-mode readers only; the issue is that getBookmarkLabels returns all bookmark labels in the workspace without publish-access filtering in SiYuan versions before v3.7.4.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73609?
The severity of CVE-2026-73609 is classified as medium with a score of 5.8.
How do I fix CVE-2026-73609?
To fix CVE-2026-73609, upgrade SiYuan to version 3.7.4 or later.
What type of vulnerability is CVE-2026-73609?
CVE-2026-73609 is an information disclosure vulnerability affecting the getBookmarkLabels endpoint.
Who is affected by CVE-2026-73609?
CVE-2026-73609 affects users of SiYuan versions prior to 3.7.4, allowing anonymous and publish-mode readers to access bookmark labels.
What data is exposed in CVE-2026-73609?
CVE-2026-73609 exposes all bookmark labels in the workspace without proper access controls.