GO-2026-6431 SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel

🗓️ 10 Sep 2026 14:48:42Reported by GoogleType

osv🔗 osv.dev👁 7 Views

SiYuan getNotebookInfo endpoint leaks notebook metadata including hidden notebooks to readers.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-72790	12 Aug 202619:07	–	attackerkb
Circl	CVE-2026-72790	8 Sep 202618:35	–	circl
CVE	CVE-2026-72790	12 Aug 202619:07	–	cve
Cvelist	CVE-2026-72790 SiYuan before v3.7.4 Information Disclosure via getNotebookInfo	12 Aug 202619:07	–	cvelist
EUVD	EUVD-2026-57450	8 Sep 202617:54	–	euvd
Github Security Blog	SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo	8 Sep 202617:54	–	github
Github Security Blog	Duplicate Advisory: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo	12 Aug 202621:31	–	github
NVD	CVE-2026-72790	12 Aug 202620:17	–	nvd
OSV	GHSA-74PJ-6G7R-J55C SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo	8 Sep 202617:54	–	osv
Positive Technologies	PT-2026-71232	12 Aug 202600:00	–	ptsecurity

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72790
github	www.github.com/siyuan-note/siyuan/commit/9edb321eb451db445f3c824380e1993c3df0fc16
vulncheck	www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getnotebookinfo

10 Sep 2026 15:15Current

CVSS 3.15.8

CVSS 46.9

EPSS0.00237

SSVC

SiYuan Information Disclosure getNotebookInfo Notebook Metadata Hidden Notebooks