SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

Source published

13 Aug 2026 11:28:12 UTC

Source modified

14 Aug 2026 22:28:54 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

CVSS 3.1 · 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

Source published

13 Aug 2026 12:17:25 UTC

Source modified

24 Oct 2026 15:10:00 UTC

Observed here

25 Oct 2026 15:19:09 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

### Summary `/api/storage/getOutlineStorage` is registered with `CheckAuth` only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, `setOutlineStorage` and `removeOutlineStorage`, both carry `CheckAdminRole` and `CheckReadonly`. Only the read path is unguarded. ### Details **Routes.** `kernel/api/router.go:103` on master, `:108` on the development branch: ```go ginServer.Handle("POST", "/api/storage/getOutlineStorage", model.CheckAuth, getOutlineStorage) ginServer.Handle("POST", "/api/storage/setOutlineStorage", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setOutlineStorage) ginServer.Handle("POST", "/api/storage/removeOutlineStorage", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeOutlineStorage) ``` **Handler.** `kernel/api/storage.go:466` on the development branch, `:469` on master, identical. It binds `docID` and calls `model.GetOutlineStorage(docID)`, which iterates the stored outline documents and returns the entry whose `DocID` matches. There is no filter function on this path at all: no `*gin.Context`, no publish-access check, no password check, no visibility check. The caller supplies the identifier and receives the payload. **What is stored.** `type OutlineDoc { DocID string; Data map[string]any }`. The client writes it from `app/src/layout/dock/Outline.ts:742`: ```js fetchPost("/api/storage/setOutlineStorage", { docID: this.blockId, val: { expandIds: this.tree.getExpandIds() } }); ``` So the payload is the set of heading block identifiers the administrator has expanded in the outline pane for that document. Secondarily, an empty result versus a populated one indicates whether the administrator has ever worked with that document's outline. **Not covered by the local-storage fix.** Commit `4daee87d4` addressed `getLocalStorage`, `getLocalStorageVal`, `getLocalStorageVals` and `FilterLocalStorageByPublishAccess`. The word "outline" does not appear in that diff. That filter was under-inclusive; this endpoint has no filter to be under-inclusive. ### Proof of Concept Kernel 3.7.2, publish mode on port 6808, `Publish.Auth.Enable` false, anonymous client with no auth header. An administrator wrote outline state through the authenticated port: ``` POST /api/storage/setOutlineStorage {"docID":"<doc id>","val":{"openIDs":["<heading id>","<heading id>"]}} → {"code":0,"msg":"","data":null} ``` The same value read back anonymously: ``` POST http://127.0.0.1:6808/api/storage/getOutlineStorage {"docID":"<doc id>"} → {"code":0,"msg":"","data":{"openIDs":["<heading id>","<heading id>"]}} ``` With that document set to the forbidden tier, on the same anonymous session: | Endpoint | Result | |---|---| | `getDoc` (control) | `protyle-password--forbidden` placeholder, content withheld | | `getOutlineStorage` | full payload returned | The control establishes that the session is correctly denied the document itself. ### Impact An anonymous reader in publish mode, or any publish `RoleReader`, retrieves the administrator's outline state for any document whose identifier they hold, including documents in the forbidden tier that the publish filters otherwise withhold entirely. The disclosed values are heading block identifiers, usable as input to other endpoints, and the presence or absence of an entry indicates whether the administrator has worked with that document. No document text is returned. Confidentiality only. ### Suggested fix Gate the read path as the write paths already are. Either add `CheckAdminRole` and `CheckReadonly` at the route, matching `setOutlineStorage` and `removeOutlineStorage`, or pass `*gin.Context` into `GetOutlineStorage` and apply `checkBlockTreeAccessableByPublishAccess` against the requested `docID` before returning anything.

Source published

1 Oct 2026 15:44:46 UTC

Source modified

7 Oct 2026 17:55:52 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Publisher rating · MODERATE

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel

Source published

7 Oct 2026 14:09:59 UTC

Source modified

7 Oct 2026 17:45:13 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.