MEDIUM 5.8 GitHub
CVE-2026-73630
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it r
### Summary
`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.
Sepa
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731093152-c7522b8db586
References
- https://github.com/advisories/GHSA-4pjg-x8qj-33j5
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5
- https://nvd.nist.gov/vuln/detail/CVE-2026-73630
- https://github.com/siyuan-note/siyuan/commit/c7522b8db586ef1e1d6fa98bbe7ca0eb9d019efe
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-23 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731093152-c7522b8db586.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.