SiYuan versions prior to 3.7.4 improperly allow path‑resolution endpoints to reveal the entire private document tree. An unauthenticated user—either an anonymous visitor or someone with a publish‑reader token—can query endpoints such as getFullHPathByID or getPathByID to discover notebook names, folder structures, and document titles. Documents that are hidden, password‑protected, or marked publish‑forbidden can still be resolved to identifiers, providing a full mapping of the internal hierarchy. This vulnerability is a classic example of missing access control (CWE‑862) and can lead to sensitive information leakage about the document organization and content.

SiYuan (siyuan-note:siyuan) applications with version 3.7.2 or earlier are affected. The flaw exists in all releases up through 3.7.2 and was fixed in version 3.7.4.

The CVSS score of 6.9 signifies a moderate impact, but the lack of authentication on publish mode means an attacker can freely probe the endpoints from any network location that can access the published instance. Because the EPSS score is not available, the exploitation likelihood is currently uncertain, yet the vulnerability is not listed in CISA’s KEV catalog, which suggests no publicly known active exploitation. The primary attack path involves sending unauthenticated HTTP requests to the vulnerable endpoints when the server runs in publish mode with Publish.Auth.Enable set to false.