The vulnerability manifests in the getEncryptedNotebookStatus endpoint of SiYuan, which returns encrypted notebook identifiers, names, and lock states without enforcing publish‑access filtering. Anonymous users and accounts operating in publish‑mode can invoke this endpoint to enumerate all encrypted notebooks and learn whether each is currently unlocked, thereby exposing sensitive notebook names and decryption state that is otherwise protected. The weakness is a missing permissions check, aligned with CWE‑862.

Vendor siyuan-note:siyuan, product SiYuan. All releases before version 3.7.4 are affected. The exact version range is unspecified, so any deployment older than 3.7.4 is potentially vulnerable.

The CVSS score of 6.9 places the issue in the medium severity range. Exploitation requires no authentication and can be performed remotely by sending a request to the vulnerable endpoint, making it accessible to anyone with network reach. The EPSS score is not reported, and the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed exploitation campaigns. Nonetheless, the lack of filtering provides an attacker with legitimate methods to gather sensitive information, so prompt remediation is advised.