SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

GHSA-XP3Q-R38W-VGQM SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

PT-2026-135864

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

CVE-2026-73610

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...

EUVD-2026-57814

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...

CVE-2026-73610

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...

CVE-2026-73610 SiYuan before v3.7.4 Information Disclosure via Local Storage

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...

CVE-2026-73610

SiYuan before v3.7.4 has an information-disclosure vulnerability in the local storage filter. The getLocalStorage endpoint returns the administrator’s full storage map with only three keys sanitized, enabling unauthenticated users (or publish readers) to retrieve closed-tab history, search keywor...

CVE-2026-73610: Authorization Bypass Through User-Controlled Key

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...