Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-12T20:17:51.407Z",
  "pubdate": "2026-08-12T20:17:51.407Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in SiYuan versions prior to v3.7.4, specifically within the getEncryptedNotebookStatus endpoint. This flaw allows unauthorized entities, including anonymous readers and accounts restricted to publish-mode, to successfully enumerate all encrypted notebooks alongside their real-time lock states. The lack of proper publish-access filtering on the affected endpoint introduces significant security risks by exposing sensitive metadata, including internal notebook identifiers, descriptive names, and decryption states currently held in memory. Consequently, malicious actors or unauthorized users with network access to the application can leverage this missing authorization control to map out sensitive data structures and ascertain the security posture of encrypted information assets without possessing any administrative privileges or prior authentication. The exploitation complexity is low due to the lack of access controls on the targeted function, enabling automated reconnaissance against exposed instances of the software.",
  "technicalDetails": "The vulnerability resides in the backend handling logic of the getEncryptedNotebookStatus endpoint within SiYuan versions prior to v3.7.4. The root cause of the issue is the absence of rigorous publish-access filtering and robust authorization checks prior to fulfilling requests for sensitive metadata regarding encrypted storage containers. When an HTTP request targeting the getEncryptedNotebookStatus function is processed by the application, it retrieves and returns internal data structures encompassing encrypted notebook identifiers, assigned names, and current lock states directly from application memory.\nUnder standard security expectations, access to internal notebook enumeration and lock status telemetry should be strictly restricted to authenticated administrative users or authorized owners of the respective cryptographic containers. However, due to the missing access control enforcement, unauthenticated anonymous readers and lower-privileged accounts operating under publish-mode restrictions can successfully invoke the endpoint and receive the complete set of status attributes. The attack flow requires no advanced payload crafting or complex state manipulation; an attacker simply sends a direct HTTP request to the vulnerable endpoint exposed by the application server.\nUpon receiving the request, the vulnerable component bypasses validation of the caller's privilege level and serializes internal state information concerning all configured encrypted notebooks. The resulting payload leaks sensitive nomenclature and operational telemetry to the client. The post-exploitation impact includes the exposure of architectural naming conventions and operational insights regarding which cryptographic containers are locked or unlocked at any given time. This reconnaissance data can subsequently be utilized to guide targeted attacks, social engineering, or further enumeration efforts against the underlying system architecture."
}