CVE-2026-45148 Details

A broken access control vulnerability has been identified in SiYuan versions prior to 3.7.0. This issue allows publish-mode Readers to access metadata from documents that are not visible to the publish service. The vulnerability is present in the searchAsset, searchTag, searchWidget, and searchTemplate endpoints, which can be exploited to enumerate metadata across the entire workspace, including tags, asset filenames, widget names, and template names. This exposure violates the trust boundary of the publish service, as users can designate notebooks to be invisible to publish, specifically to protect this metadata from public access.

Users can update to SiYuan version 3.7.0 or later, where this vulnerability has been fixed.