PT-2026-57010 · Siyuan Note · Siyuan

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-59853

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-59853

Produtos afetados

Siyuan

Referências · 4

• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 · Nota
• https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef31605077d36 · Nota
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59853 · Nota de Segurança