CVE-2026-73606: Siyuan-Note Siyuan

Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days.

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.

Affected products

• Siyuan-Note Siyuan: before 3.7.4 (fixed in 3.7.4)

Published 2026-08-13. Last modified 2026-08-26.