SiYuan versions earlier than 3.7.4 expose notebook metadata—such as names, document counts, sizes, and timestamps—through the /api/notebook/getNotebookInfo endpoint without performing any authorization check. The missing authorization (CWE‑862) allows an attacker to read information about closed or non‑published notebooks that should be hidden from ordinary users, potentially revealing organizational structure or intent.

The vulnerability affects the SiYuan note‑taking application released by siyuan-note:siyuan prior to version 3.7.4. No sub‑product or build information beyond the pre‑3.7.4 line is listed.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is not available, so the precise likelihood of exploitation is unknown, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a request to /api/notebook/getNotebookInfo that does not require authentication, meaning any machine that can reach the API can trigger the flaw.