Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73610SiYuan before v3.7.4 Information Disclosure via Local Storage

Medium 5.8

In plain English

A medium-severity authorization bypass via user-controlled key in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-xp3q-r38w-vgqm) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Local Storage third-party-advisory