What is CVE-2026-73049?

CVE-2026-73049 is a medium-severity vulnerability in Siyuan-Note Siyuan, classified under Incorrect Authorization. CVSS score: 5.8/10. Published 2026-08-14.

How severe is CVE-2026-73049?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Auth bypass in Siyuan-Note Siyuan

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Siyuan-note Siyuan — versions 0, 3.7.4

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-73049?: CVE-2026-73049 is a medium-severity vulnerability in Siyuan-Note Siyuan, classified under Incorrect Authorization. CVSS score: 5.8/10. Published 2026-08-14.
How severe is CVE-2026-73049?: Medium severity. CVSS v3 base score is 5.8 out of 10.