What’s Vulnerable › Vulnerabilities

CVE-2026-73049: SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-14 · updated 2026-08-26
• Weakness: CWE-863

Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

Affected products

• siyuan-note siyuan: before 3.7.4 — fixed in 3.7.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984
• https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984

Get alerted when CVE-2026-73049 or the next vulnerability affects your stack