GHSA-VG99-7GJ7-2FR5 SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

🗓️ 01 Oct 2026 16:29:35Reported by GoogleType

osv🔗 osv.dev👁 2 Views

SiYuan discloses password-protected document references via /api/block/getRefIDs.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-73606	1 Oct 202616:29	–	circl
CVE	CVE-2026-73606	13 Aug 202611:28	–	cve
Cvelist	CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs	13 Aug 202611:28	–	cvelist
EUVD	EUVD-2026-57810	1 Oct 202616:29	–	euvd
Github Security Blog	Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block	13 Aug 202612:31	–	github
Github Security Blog	SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block	1 Oct 202616:29	–	github
NVD	CVE-2026-73606	13 Aug 202612:17	–	nvd
Positive Technologies	PT-2026-71434	13 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-73606: Authorization Bypass Through User-Controlled Key	13 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs	13 Aug 202611:28	–	vulnrichment

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-vg99-7gj7-2fr5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-73606
github	www.github.com/siyuan-note/siyuan
github	www.github.com/siyuan-note/siyuan/releases/tag/v3.8.0
vulncheck	www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getrefids

01 Oct 2026 16:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.8

EPSS0.00325

SiYuan information disclosure getRefIDs /api/block/getRefIDs