The flaw in SiYuan versions before 3.7.4 lies in the /api/tag/getTag endpoint, which returns tag names and occurrence counts from password‑protected documents even when a user does not provide the required publish password. This incomplete permission check lets an unauthenticated actor enumerate the internal terminology of protected files, revealing sensitive organizational information. The weakness is categorised as CWE‑863, signifying invalid validation of permissions or access control.

The vulnerability affects the SiYuan note application, specifically any build earlier than version 3.7.4. All deployments that expose the /api/tag/getTag API without proper access control are impacted, and any user who can reach the endpoint without credentials can exploit the flaw.

The CVSS base score of 6.9 indicates moderate severity. Exploitation is trivial: an attacker simply makes an unauthenticated HTTP request to the tag endpoint, gaining tag data from password‑protected documents. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Because the API is publicly reachable, the attack can be carried out remotely from any host that can connect to the SiYuan server.