The susceptibility lies in the getAttributeViewBacklinks endpoint of SiYuan, which mistakenly consults the forbidden access list instead of the intended visibility list when filtering backlink entries. Because of this logic flaw, an unauthenticated user can submit the identifier of any publicly visible database row and receive a list that includes references to documents that are actually hidden. The returned data contains the database name, the row title, and the full document path of the concealed documents, thereby exposing sensitive information that should be restricted.

All releases of Siyuan Note before version 3.7.4 are vulnerable. Users running the open‑source editor Siyuan with any version earlier than 3.7.4 are susceptible if the getAttributeViewBacklinks endpoint is exposed to external traffic.

The CVSS score of 6.9 reflects a medium‑severity disclosure risk. The EPSS score is unavailable, but the vulnerability is exploitable by anonymous traffic: any unauthenticated client can craft a request to the endpoint with a known public row identifier. Since no special privileges are required and the endpoint returns full document locations, the impact is a direct breach of confidentiality. The vulnerability is not currently listed in CISA’s KEV catalog, but organizations should monitor for exploitation attempts and verify that updates have been applied.