MEDIUMVulnerability
CVE-2026-73609
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.
Properties
- severity
- MEDIUM
- score
- 5.8
- cve_id
- CVE-2026-73609
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- published_at
- 2026-08-13T12:17:25.463
- last_modified
- 2026-08-26T16:57:52.167
Related Entities (2)
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Missing Authorization
Explore deeper with Ninja Signal's threat intelligence graph