CVE-2026-103763: Siyuan-Note Siyuan

Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days.

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.

Affected products

• Siyuan-Note Siyuan: before 3.8.5 (fixed in 3.8.5)

Published 2026-10-02. Last modified 2026-10-02.