SiYuan note versions before 3.7.4 contain a publish‑boundary bypass in the WebSocket broadcast sessions. An unauthenticated client can open a WebSocket connection to the publish surface and receive unfiltered edit events, including those for password‑protected or otherwise forbidden documents. The missing authorization check – a form of weakness enumerated as CWE‑862 – allows attackers to read any content that passes through the WebSocket stream. This results in a direct loss of confidentiality for all documents served by the instance.

The vulnerability affects the SiYuan Note product, specifically all releases prior to v3.7.4. Any instance running those versions with the publish service enabled is susceptible unless the publish functionality has been disabled or otherwise protected by network controls.

The CVSS score of 9.2 indicates a critical risk. EPSS is not available and the issue is not listed in the CISA KEV catalog, but the lack of an authentication gate on the WebSocket endpoint makes exploitation straightforward for any network actor who can reach the publish surface. An attacker simply establishes a WebSocket connection and passively receives real‑time content events, leading to comprehensive data exfiltration without any additional credentials or system compromise.