CVE-2026-85578CWE-862broken-access-control

CVE-2026-85578

Medium · published September 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-04T16:17Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8ggq-wq3f-vxrw · [email protected]https://www.vulncheck.com/advisories/siyuan-through-3.8.1-authorization-bypass-via-getfile · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:29Z
    SiYuan through 3.8.1 Authorization Bypass via getFile
    cvelistv5