GHSA-4PJG-X8QJ-33J5 SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

CVE-2026-73045 SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting ...

CVE-2026-73045

SiYuan before 3.7.4 has an improper restriction of excessive authentication attempts in the authFilePublishAccess endpoint, allowing unauthenticated attackers to brute-force per-notebook publish passwords with no rate limiting or CAPTCHA, potentially granting access to password-protected publishe...

CVE-2026-73045: Improper Restriction of Excessive Authentication Attempts

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting ...

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

PT-2026-72012

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/filetree/authFilePublishAccess' endpoint, which is accessible anonymously. The endpoint does not return failure codes, instead signaling outcomes...

CVE-2026-73630: Observable Discrepancy

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...