CVE-2026-85579: SiYuan before v3.8.2 Information Disclosure via undoState
SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with reader access can exploit it. The user must know the root ID of a document they are allowed to view.
What information is exposed?
The endpoint can disclose internal root IDs for other documents, including private or unpublished documents, when those documents were modified in the same cross-document transaction. It can also reveal relationships between those documents, but does not directly expose document body content.
Which versions are affected and what version fixes it?
The issue is confirmed in SiYuan v3.8.1 and is fixed in v3.8.2.
How can an organization determine whether it may be exposed?
Review whether reader-role users can send POST requests to /api/transactions/undoState and whether cross-document transactions may include private or unpublished documents. Systems running a version before v3.8.2 may be affected.