CVE-2026-73049

LOWCVSS 6.9 · MEDIUM

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

DailyCVE@dailycve1d
🟠 SiYuan, Information Disclosure, #CVE-2026-73049 (Moderate) -DC-Oct2026-3707 https://dailycve.com/siyuan-information-disclosure-cve-2026-73049-moderate-dc-oct2026-3707/
0000019
245 followersView on X

Explore more

Back to dashboard