CVE-2026-73607: SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

October 1, 2026

/api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document’s stored outline state, regardless of the document’s publish tier.

The two write endpoints for the same data, setOutlineStorage and removeOutlineStorage, both carry CheckAdminRole and CheckReadonly. Only the read path is unguarded.

References

github.com/advisories/GHSA-53fp-9jmv-227g
github.com/siyuan-note/siyuan/releases/tag/v3.8.0
github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g
nvd.nist.gov/vuln/detail/CVE-2026-73607
www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage

Code Behaviors & Features

Detect and mitigate CVE-2026-73607 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →