CVE-2026-85579: Siyuan-Note Siyuan

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.

Affected products

• Siyuan-Note Siyuan: before 3.8.2 (fixed in 3.8.2)

Published 2026-09-04. Last modified 2026-09-08.