SiYuan versions prior to 3.7.3 allow unauthenticated users to read the full contents of password‑protected documents in publish mode because content‑returning endpoints such as getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc do not enforce the password check that protects the main document endpoint, resulting in an authorization bypass (CWE‑288) that compromises confidentiality and may affect data integrity.

This vulnerability affects the Siyuan Note application distributed by siyuan-note:siyuan; any installation using a release before v3.7.3 that operates in publish mode is vulnerable.

The CVSS score of 9.2 marks it as Critical. Though the EPSS score is not available, the straightforward attack path—harvesting block identifiers from exposed read‑only endpoints and then requesting protected content from the unprotected endpoints—indicates that exploitation is feasible over the network. The flaw is not listed in the CISA KEV catalog, but its lack of authentication checks demands urgent attention.