{"id":"CVE-2026-73607","revision":null,"records":[{"revision":"6ed7b85417064dae8339bd3039f53508","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73607","aliases":[],"title":"SiYuan before v3.7.4 Information Disclosure via getOutlineStorage","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.","state":0,"publishedAt":"2026-08-13T11:28:12.47+00:00","modifiedAt":"2026-08-14T22:28:54.246+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73607","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73607","identifiers":["CVE-2026-73607"]},"retained":false,"historicalAffected":[]},{"revision":"bf839e49c27d42bfb19f0c8ea585bb38","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73607","aliases":[],"title":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any d…","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.","state":0,"publishedAt":"2026-08-13T12:17:25.183+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73607","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-08-13T12:17:25.183","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73607","identifiers":["CVE-2026-73607"]},"retained":false,"historicalAffected":[]},{"revision":"5aa3acf2d5af42cabd68ffbfb3b9114d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-53fp-9jmv-227g","aliases":["CVE-2026-73607","GO-2026-6624"],"title":"SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check","description":"### Summary\n\n`/api/storage/getOutlineStorage` is registered with `CheckAuth` only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier.\n\nThe two write endpoints for the same data, `setOutlineStorage` and `removeOutlineStorage`, both carry `CheckAdminRole` and `CheckReadonly`. Only the read path is unguarded.\n\n### Details\n\n**Routes.** `kernel/api/router.go:103` on master, `:108` on the development branch:\n\n```go\nginServer.Handle(\"POST\", \"/api/storage/getOutlineStorage\",    model.CheckAuth, getOutlineStorage)\nginServer.Handle(\"POST\", \"/api/storage/setOutlineStorage\",    model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setOutlineStorage)\nginServer.Handle(\"POST\", \"/api/storage/removeOutlineStorage\", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeOutlineStorage)\n```\n\n**Handler.** `kernel/api/storage.go:466` on the development branch, `:469` on master, identical. It binds `docID` and calls `model.GetOutlineStorage(docID)`, which iterates the stored outline documents and returns the entry whose `DocID` matches. There is no filter function on this path at all: no `*gin.Context`, no publish-access check, no password check, no visibility check. The caller supplies the identifier and receives the payload.\n\n**What is stored.** `type OutlineDoc { DocID string; Data map[string]any }`. The client writes it from `app/src/layout/dock/Outline.ts:742`:\n\n```js\nfetchPost(\"/api/storage/setOutlineStorage\", {\n    docID: this.blockId,\n    val: { expandIds: this.tree.getExpandIds() }\n});\n```\n\nSo the payload is the set of heading block identifiers the administrator has expanded in the outline pane for that document. Secondarily, an empty result versus a populated one indicates whether the administrator has ever worked with that document's outline.\n\n**Not covered by the local-storage fix.** Commit `4daee87d4` addressed `getLocalStorage`, `getLocalStorageVal`, `getLocalStorageVals` and `FilterLocalStorageByPublishAccess`. The word \"outline\" does not appear in that diff. That filter was under-inclusive; this endpoint has no filter to be under-inclusive.\n\n### Proof of Concept\n\nKernel 3.7.2, publish mode on port 6808, `Publish.Auth.Enable` false, anonymous client with no auth header.\n\nAn administrator wrote outline state through the authenticated port:\n\n```\nPOST /api/storage/setOutlineStorage\n{\"docID\":\"<doc id>\",\"val\":{\"openIDs\":[\"<heading id>\",\"<heading id>\"]}}\n→ {\"code\":0,\"msg\":\"\",\"data\":null}\n```\n\nThe same value read back anonymously:\n\n```\nPOST http://127.0.0.1:6808/api/storage/getOutlineStorage\n{\"docID\":\"<doc id>\"}\n→ {\"code\":0,\"msg\":\"\",\"data\":{\"openIDs\":[\"<heading id>\",\"<heading id>\"]}}\n```\n\nWith that document set to the forbidden tier, on the same anonymous session:\n\n| Endpoint | Result |\n|---|---|\n| `getDoc` (control) | `protyle-password--forbidden` placeholder, content withheld |\n| `getOutlineStorage` | full payload returned |\n\nThe control establishes that the session is correctly denied the document itself.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, retrieves the administrator's outline state for any document whose identifier they hold, including documents in the forbidden tier that the publish filters otherwise withhold entirely. The disclosed values are heading block identifiers, usable as input to other endpoints, and the presence or absence of an entry indicates whether the administrator has worked with that document.\n\nNo document text is returned. Confidentiality only.\n\n### Suggested fix\n\nGate the read path as the write paths already are. Either add `CheckAdminRole` and `CheckReadonly` at the route, matching `setOutlineStorage` and `removeOutlineStorage`, or pass `*gin.Context` into `GetOutlineStorage` and apply `checkBlockTreeAccessableByPublishAccess` against the requested `docID` before returning anything.","state":0,"publishedAt":"2026-10-01T15:44:46+00:00","modifiedAt":"2026-10-07T17:55:52.0921123+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260812083335-251596fc0de2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g","https://nvd.nist.gov/vuln/detail/CVE-2026-73607","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage"],"sourceUrl":"https://github.com/advisories/GHSA-53fp-9jmv-227g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-53fp-9jmv-227g","identifiers":["GHSA-53fp-9jmv-227g","CVE-2026-73607","GO-2026-6624"]},"retained":false,"historicalAffected":[]},{"revision":"e01c1ed76ceb4109b129f6f781a44bcc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6624","aliases":["CVE-2026-73607","GHSA-53fp-9jmv-227g"],"title":"SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-10-07T14:09:59+00:00","modifiedAt":"2026-10-07T17:45:13.4765833+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260812083335-251596fc0de2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g","https://nvd.nist.gov/vuln/detail/CVE-2026-73607","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6624","license":"OSV · upstream source license applies","key":"osv:GO-2026-6624","identifiers":["GO-2026-6624","CVE-2026-73607","GHSA-53fp-9jmv-227g"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.0869487+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.0869513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-1a687ad2a0b90150aa7d97c9f39e63de695ae2db23e31ebc28df1492c461b23c-5e0a45ae0cf63c80268dd44eaeb20879d480eba4da3306bde3dcd925fa4c114f","complete":true,"records":414047,"lastAttemptAt":"2026-10-25T23:02:08.5196863+00:00","lastSuccessAt":"2026-10-25T23:02:08.4495153+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.5196863+00:00","snapshotPublishedAt":"2026-10-25T22:26:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-25T23:02:11.7890287+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.087647+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.08765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-25T23:02:09.6218557+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-25T23:02:08.8808579+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8808579+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-25T23:02:08.6737644+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.6737644+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-25T23:02:08.8933341+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8933341+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11236ada05a0588e51df37636716526867f73fb127392c49680b6f8561496a99","complete":true,"records":230781,"lastAttemptAt":"2026-10-25T23:02:08.7805888+00:00","lastSuccessAt":"2026-10-25T22:04:07.173333+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.7805888+00:00","snapshotPublishedAt":"2026-10-25T21:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}