SiYuan suffers an information disclosure flaw in the undoState API. The endpoint exposes the peekMutatedRootIDs list from the undo‑log for a supplied root identifier, without enforcing publish‑access filters. An authenticated reader who can supply a visible document’s rootID can learn the internal root IDs of other documents that were updated in the same transaction, revealing internal identifiers and cross‑document relationships. The breach does not reveal document body contents, but discloses structural metadata that could aid further attacks. The weakness corresponds to CWE-639, selective disclosure.

The vulnerability affects the Siyuan note‑taking application from the vendor Siyuan‑Note, version 3.8.1 and earlier, with the fix introduced in v3.8.2. The affected component is the reader‑accessible POST /api/transactions/undoState endpoint in the Siyuan web API.

The CVSS base score is 5.3, indicating a medium severity. The EPSS score is not available, so the current exploitation likelihood is unknown but the vulnerability is publicly disclosed, giving potential adversaries enough time. It is not listed in the CISA KEV catalog. An attacker who has read permissions and can guess or obtain a valid root ID can hit the vulnerable endpoint to pull other documents’ internal identifiers. The attack requires authentication; the attacker would need to be a legitimate reader who knows a visible document’s root ID. If cross‑document transactions are common, the attack surface expands accordingly.