CVE-2026-74906: SiYuan before v3.7.4 Incorrect Authorization via Publish Access
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances running a SiYuan version before v3.7.4 are affected where publish-mode reader-facing endpoints are exposed to anonymous visitors. The issue affects eight endpoint categories: search, backlinks, asset content, saved criteria, recent documents, graph, and tags.
What does an attacker need to exploit this?
No authentication, privileges, or user interaction are required. An anonymous visitor can query the affected publish-mode endpoints to discover and read documents that were explicitly marked as forbidden from publishing.
What should be done if patching is not immediately possible?
Upgrade SiYuan to v3.7.4 or later. If upgrading cannot happen immediately, restrict anonymous access to publish-mode reader-facing endpoints to prevent unauthenticated retrieval of unpublished content.
How can I determine whether unpublished documents are already exposed?
Review whether the affected publish-mode endpoints are accessible anonymously and test whether documents marked forbidden from publishing can be returned through search, backlink, asset content, saved criteria, recent-document, graph, or tag requests. Exposure of such content indicates the instance is affected.