SiYuan through version 3.8.1 contains an authorization bypass flaw in the /api/file/getFile endpoint that allows users with the reader role to retrieve files from notebooks explicitly configured as Visible:false. This weakness enables a reader to read private workspace files, including notebook metadata and internal configuration, simply by knowing the hidden notebook identifier and file path. The vulnerability is a classic example of Missing Authorization (CWE-862), exposing sensitive data and potentially internal configuration to an unauthorized party.

The affected product is Siyuan, a note-taking application. All releases up to and including 3.8.1 are impacted; this includes any installation or environment running those versions.

The CVSS v3.1 score of 7.1 indicates a high severity level. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first have an account with the reader role and then send a crafted HTTP request to /api/file/getFile, providing the hidden notebook identifier and file path. Once the request is authenticated, the server returns the requested file, bypassing the visibility restriction. The lack of additional prerequisites means the flaw can be exploited in any environment where reader role users are present.