ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-73630

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Published Aug 14, 2026 · catalog updated Oct 23, 2026 · SiYuan: authFilePublishAccess distinguishes hidden

Check if you run it

No confirmed exploitation is on record for CVE-2026-73630. EPSS is 0.34%. Act only if a listed version of SiYuan: authFilePublishAccess distinguishes hidden is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SiYuan: authFilePublishAccess distinguishes hidden).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Version ranges on file
Affected products
Go github.com/siyuan-note/siyuan/kernel · go github.com/siyuan-note/siyuan/kernel · golang github.com · vendor siyuan-note siyuan

### Summary is registered with only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier. Separately, hidden and forbidden entries carry an empty password. Submitting therefore satisfies the equality check for them, and the server responds by issuing for a document whose own tier is forbidden. ### Details **Route,** identical on both refs: No , no . **Handler,** on the development branch and on master. is never assigned on the failure path, so every response carries . The branch is: **The cookie is issued for forbidden documents.** Entries at the hidden and forbidden tiers store . A request with therefore makes true for them, and the handler takes the success branch. The server issues a publish-auth cookie for a document it otherwise treats as inaccessible. The cookie itself confers nothing, because those tiers are decided before any password check elsewhere in the codebase. The defect is that the endpoint's success signal does not correspond to access being granted, and that signal is observable. **Three distinguishable outcomes.** With , one request per candidate identifier: | Tier of the target | | Body | |---|---|---| | Public (no publish-access entry) | absent | | | Nonexistent identifier | absent | | | Password-protected | absent | | | Hidden | **present** | | | Forbidden | **present** | | Public and nonexistent are indistinguishable from each other, which is correct. Everything else separates. A caller learns whether a given identifier names a password-protected document, or a document that exists at the hidden or forbidden tier, which is precisely the class the publish tiers exist to conceal. **Identifiers are readily avail

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/siyuan-note/siyuan/kernel0 → 0.0.0-20260731093152-c7522b8db586
  • go github.com/siyuan-note/siyuan/kernel< 0.0.0-20260731093152-c7522b8db586
  • golang github.comversion unspecified
  • vendor siyuan-note siyuanversion unspecified

How to fix CVE-2026-73630

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-73630. EPSS is 0.34%. Act only if a listed version of SiYuan: authFilePublishAccess distinguishes hidden is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.0.0-20260731093152-c7522b8db586, < 0.0.0-20260731093152-c7522b8db586. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-203: Observable Discrepancy. EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    ### Summary is registered with only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at

  2. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260731093152-c7522b8db586

  3. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260731093152-c7522b8db586

  4. Oct 23, 2026 · GitHub Advisory Database

    Updated

    ### Summary is registered with only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at

Sources

  • CVE.orgVulnerability recordCVE-2026-73630

    SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the res

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-73630

    30-day exploitation probability 0.34%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-4pjg-x8qj-33j5

    SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-73630

    /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-4pjg-x8qj-33j5

    SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-4pjg-x8qj-33j5

    SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

    osv.dev

References

Freshness

Last verified in this catalog Oct 24, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.