SiYuan, a personal knowledge management system, contains an API flaw that permits attackers to read any stored document without authorization. The vulnerability lies in how the /api/file/readDir endpoint retrieves document IDs and how /api/block/getChildBlocks then returns the content of each document. Because the system does not enforce proper access controls, an attacker could extract confidential information from any user’s documents. The weakness is classified as CWE-125, reflecting improper bounds checking for reading data.

This flaw affects SIYUAN products by the vendor siyuan-note, specifically the siyuan application. Versions older than 3.6.2 are vulnerable as they use the flawed API chain. The official CPE mapping indicates cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*. Users deploying any SIYUAN instance before the 3.6.2 release need to verify their version and upgrade if required.

The CVSS score of 9.8 marks this issue as critical, indicating full compromise of confidentiality. The EPSS score is below 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote via the publishing service’s exposed APIs; an unauthenticated attacker could invoke the API endpoints to enumerate and extract all documents. The exploitation path requires no special privileges, making the risk significant for organizations relying on SIYUAN for private knowledge storage.