HIGH 8.7 NVD
CVE-2026-74906
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility li
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p
- https://www.vulncheck.com/advisories/siyuan-before-incorrect-authorization-via-publish-acc
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-18 via NVD.
vulnfeed aggregates 11001 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.