Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-13T12:17:25.183Z",
  "pubdate": "2026-08-13T12:17:25.183Z",
  "executiveSummary": "SiYuan versions prior to v3.7.4 suffer from an unauthorized information disclosure vulnerability located within the endpoint /api/storage/getOutlineStorage. This security flaw enables unauthenticated or unauthorized malicious actors to bypass access controls and retrieve sensitive outline state data, including internal heading identifiers, for arbitrary documents within the system. The impact of this vulnerability encompasses the exposure of confidential document structures and metadata, even for restricted documents that the requester is explicitly forbidden to access. This presents a significant risk to data confidentiality and violates the principle of least privilege. Attackers require network access to the target SiYuan instance and the ability to interact with the HTTP API. No prior authentication, special privileges, or complex interaction are necessary to exploit this flaw, as the vulnerable endpoint fails to execute any authorization validation checks against the supplied document identifiers.",
  "technicalDetails": "The vulnerability resides in the backend routing and controller logic handling the /api/storage/getOutlineStorage endpoint within SiYuan prior to v3.7.4. The root cause of the security defect is the complete absence of authorization checks and access control validation within the request handling pipeline for this specific API route. When an HTTP request is dispatched to /api/storage/getOutlineStorage, the application logic directly processes the supplied document identifier parameter without verifying whether the requesting user or session possesses the requisite permissions to view the targeted document. Network exposure of the API allows any remote attacker capable of reaching the HTTP service to interact directly with the vulnerable endpoint. Exploitation occurs step-by-step as follows: First, the attacker identifies a target document identifier or enumerates potential identifiers. Second, the attacker formulates an HTTP request targeting the /api/storage/getOutlineStorage endpoint, appending the targeted document identifier as a parameter. Third, because the backend component fails to perform session validation, role checks, or document-level access control lists (ACLs) verification, the application processes the request. Finally, the server queries the internal storage mechanism and returns the outline state, encompassing structural metadata and heading identifiers of the forbidden document, directly in the HTTP response body. Post-exploitation impact is characterized by unauthorized intelligence gathering, where attackers can systematically map document hierarchies, uncover internal naming conventions, and harvest sensitive headings from restricted notes. Remediation requires the implementation of strict authentication and authorization checks within the /api/storage/getOutlineStorage handler to ensure that requestors can only access outline storage data for documents they are explicitly authorized to view."
}