CVE-2026-74906CWE-863broken-access-control

CVE-2026-74906

High · published August 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

34.0

In the wild

Unconfirmed

What it is

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00409 · 34.0th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-08-18T16:19Z

References (3)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p · [email protected]https://www.vulncheck.com/advisories/siyuan-before-incorrect-authorization-via-publish-access · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-48p5-pffc-5r9p · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

18 AUG 11:19Z
SiYuan before v3.7.4 Incorrect Authorization via Publish Access
cvelistv5