PT-2026-57010 · Siyuan Note · Siyuan

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-59853

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59853

Affected Products

Siyuan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-59853 · Security Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 · Note
• https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef31605077d36 · Note
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83 · Note