CVE-2026-73630 json
SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess
published 2mo ago modified 6d ago also EUVD-2026-58620 , GHSA-4pjg-x8qj-33j5 , GO-2026-6828
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.
Patch / fix
- go github.com/siyuan-note/siyuan/kernel 0.0.0-20260731093152-c7522b8db586
- siyuan-note siyuan 3.7.4
Is CVE-2026-73630 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | <0.0.0-20260731093152-c7522b8db586 |
0.0.0-20260731093152-c7522b8db586 |
Affected products
- siyuan-note siyuan
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/siyuan-note/siyuan/commit/c7522b8db586ef1e1d6fa98bbe7ca0eb9d019efe
web
-
github.com
/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-73630
advisory
-
github.com
/siyuan-note/siyuan
package
-
github.com
/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4
web
Sources
- CVE List CVE-2026-73630
- GitHub Advisory GHSA-4pjg-x8qj-33j5
- NVD CVE-2026-73630
- OSV GO-2026-6828
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.