CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass in the /api/file/getFile endpoint. Attackers with reader role can retrieve files from notebooks explicitly configured as Visible:false , gaining access to private workspace files including notebook metadata and internal configuration by knowin...