PT-2026-40727 · Siyuan · Siyuan

Starplatinu · Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-45148

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description Broken access control in the publish-mode allows readers to enumerate metadata from documents that are invisible to the publish service. This occurs because certain search handlers do not filter responses for users with the RoleReader role, allowing them to bypass the trust boundary and access information from password-protected or publish-ignored notebooks. An attacker can enumerate all tag strings, asset filenames, widget names, and template names across the entire workspace.

The affected API endpoints are:

• '/api/search/searchTag'
• '/api/search/searchTemplate'
• '/api/search/searchWidget'
• '/api/search/searchAsset'

Recommendations Update to version 3.7.0. As a temporary workaround, restrict access to the '/api/search/searchTag', '/api/search/searchTemplate', '/api/search/searchWidget', and '/api/search/searchAsset' endpoints to minimize the risk of metadata enumeration.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45148

GHSA-FMH9-GPQH-G53G

Affected Products

Siyuan

References · 4

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmh9-gpqh-g53g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45148 · Security Note
• https://osv.dev/vulnerability/GHSA-fmh9-gpqh-g53g · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note