Description

SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T12:17:19.780Z",
  "pubdate": "2026-09-04T12:17:19.780Z",
  "executiveSummary": "SiYuan v3.8.1 contains an information disclosure vulnerability within the /api/transactions/undoState endpoint. The flaw arises from insufficient access control enforcement, specifically the failure to apply visibility filtering on the undo-log stack returned by the API. An authenticated attacker with reader-level permissions can exploit this to enumerate internal document root IDs, including those corresponding to private or restricted documents that should remain inaccessible. By querying the API with a known root ID, the attacker can extract metadata regarding cross-document relationships and hidden identifiers. This represents a significant breach of logical access control, potentially exposing internal system structure and sensitive document metadata. The vulnerability is mitigated in v3.8.2.",
  "technicalDetails": "The vulnerability resides in the /api/transactions/undoState endpoint, which is designed to interact with the global undo-log stack of the SiYuan application. The application maintains a historical record of document modifications, including those occurring within cross-document transactions. During a transaction, multiple root IDs may be mutated or associated within the undo-log structure.\nThe root cause of the vulnerability is an improper access control check during the processing of the POST request. While the endpoint requires authentication, the server-side logic fails to perform a cross-reference check between the identity of the requester and the sensitivity of the data contained within the requested transaction state. Specifically, the peekMutatedRootIDs list, which aggregates all mutated root IDs associated with a specific operation, is returned to the user without validating whether the user possesses adequate permissions to view all documents referenced in the list.\nTo exploit this, an attacker must possess authenticated access to the SiYuan instance as a reader. The attacker initiates a POST request to /api/transactions/undoState, supplying a known root ID of a document they are authorized to access. Because the application logic retrieves the transaction context based on the supplied root ID—and because that context is shared across document modifications—the server processes the global undo-log state. The endpoint then returns the complete list of peekMutatedRootIDs associated with that transaction history.\nThe attack flow is as follows: 1) The attacker identifies a root ID for a document to which they have legitimate read access. 2) The attacker crafts a POST request to the /api/transactions/undoState endpoint, injecting the target root ID into the request body. 3) The server retrieves the global undo-log metadata without filtering for the requester's access rights. 4) The server sends an HTTP response containing the peekMutatedRootIDs, which include identifiers for private or unpublished documents modified in the same transaction as the target document. 5) The attacker parses this response to harvest the internal IDs of restricted resources. While the exploit does not directly expose the document body content, it facilitates reconnaissance by mapping the system's internal document hierarchy and revealing sensitive relationships between private and public data. This vulnerability was confirmed in v3.8.1 and resolved in v3.8.2."
}