This vulnerability arises from a broken access control in SiYuan's publish API endpoint /api/bookmark/getBookmark. Because the filter does not enforce the publish password when the request context is nil, an unauthenticated visitor can retrieve bookmarked blocks from documents that are otherwise password‑protected. The result is that sensitive content can be read by anyone who can reach the publish service, leading to a confidentiality breach. The weakness is a classic example of CWE‑863: Missing Authorization.

The flaw affects the SiYuan personal knowledge‑management application, specifically all releases prior to version 3.6.2. Attackers only need access to the publish service exposed by a SiYuan instance. The issue is tied to the bookmark API, so Siyuan products that offer host‑based publish read‑only mode are impacted.

The CVSS base score of 7.5 indicates high severity, and the EPSS value of 7 % suggests a modest but realistic likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits are publicly documented. Exploitation requires network access to the publish endpoint and the presence of at least one bookmark in a protected document; no special authentication is needed, making the attack path straightforward for an attacker with internet exposure to the service.