The vulnerability arises in SiYuan versions before 3.7.4 because the API endpoint getAttributeViewKeysByID does not enforce publish‑access filtering. Authenticated users can query this endpoint and obtain the database schema, field descriptions, select vocabularies, and template expressions. The getBlockDefIDsByRefText and getBlockRelevantIDs endpoints similarly expose workspace‑wide block identifiers without respecting publish scopes, letting attackers discover block IDs that belong to hidden or password‑protected documents. This leads to a confidentiality compromise where attackers can learn the structure of the database and locate sensitive content that should not be exposed outside the authorized publication boundary. From the description, the primary impact is the leakage of internal metadata and potential exposure of hidden document identifiers. The weakness is a missing authorization check (CWE‑862).

SiYuan Note software. All releases prior to version 3.7.4 of the Siyuan product are susceptible. Users of earlier versions that have not applied the 3.7.4 security update should consider themselves at risk.

The CVSS base score of 6.9 places this vulnerability in the moderate severity range. Because the exploitation requires an authenticated user with read permissions, the likelihood of an attacker achieving the exploit depends on the number of privileged accounts available. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. An attacker with legitimate read access could retrieve the exposed database schema and enumerate block IDs, potentially locating and accessing content from documents that should remain private.