6 matches found
PT-2026-122415
Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...
GHSA-VG9Q-FC8F-43F3 Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess...
Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess...
CVE-2026-73630
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...
PT-2026-122445
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess...
CVE-2026-73630: Observable Discrepancy
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...