Medium severity5.8NVD Advisory· Published Aug 14, 2026· Updated Aug 26, 2026

CVE-2026-73049

Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.7.4

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984nvd
www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinksnvd

News mentions

Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 15, 2026

cvss	0.377
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000