CVE-2026-85579 Details
Description
SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.
An information disclosure vulnerability exists in SiYuan version 3.8.1, specifically within the reader-accessible POST /api/transactions/undoState endpoint. This vulnerability, fixed in version 3.8.2, arises because the endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a user-supplied root ID without applying necessary publish-access visibility filters. As a result, an authenticated reader who knows the root ID of a visible document can access the internal root IDs of other documents, including private or unpublished ones, that were modified in the same cross-document transaction. This disclosure reveals internal identifiers and cross-document relationships, although the actual contents of the documents are not exposed.
Users should update to SiYuan version 3.8.2 or later. For those on version 3.8.1, the undoState endpoint can be modified to apply the same publish-access visibility filters used by content APIs, ensuring that only authorized root IDs are returned.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gf8-q9ch-w732 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gf8-q9ch-w732 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-undostate | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | 3.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |