What is CVE-2026-74906?

CVE-2026-74906 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2026-08-18.

How severe is CVE-2026-74906?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Siyuan-Note Siyuan

CVE-2026-74906

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Siyuan-note Siyuan

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-74906?: CVE-2026-74906 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2026-08-18.
How severe is CVE-2026-74906?: High severity. CVSS v3 base score is 7.5 out of 10.