CVE-2026-72790

SiYuan before v3.7.4 has an information disclosure in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization. Attackers can read notebook names, document counts, sizes, and timestamps for notebooks that are closed or not published. The disclosure is a meta...