GO-2026-6634 SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel...

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Summary /api/attr/getBookmarkLabels is registered with CheckAuth only and applies no filtering of any kind. It runs a scan of the entire blocks table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark...

GHSA-J4PH-9XWF-WCJ4 SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Summary /api/attr/getBookmarkLabels is registered with CheckAuth only and applies no filtering of any kind. It runs a scan of the entire blocks table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark...

PT-2026-105524

Summary /api/attr/getBookmarkLabels is registered with CheckAuth only and applies no filtering of any kind. It runs a scan of the entire blocks table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark...

GHSA-7V6H-J59W-8QFP Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4ph-9xwf-wcj4. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that...

Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4ph-9xwf-wcj4. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that...

CVE-2026-73609 SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the...

CVE-2026-73609

SiYuan versions before v3.7.4 are affected by an information disclosure vulnerability in the getBookmarkLabels endpoint, which returns all bookmark labels in a workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across...

PT-2026-71437

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getBookmarkLabels' endpoint. The system returns all bookmark labels within the workspace without applying publish-access filtering. This allows anonymous...

PT-2026-105494

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4ph-9xwf-wcj4. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that...

CVE-2026-73609: Missing Authorization

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the...