Description
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
siyuan-note siyuan
Default version status: unaffected
0 to < 3.7.4affected3.7.4unaffected
pkg:golang/github.com/siyuan-note/siyuan/kernel