{"id":"GHSA-mxjf-vfmv-qfm6","title":"Duplicate Advisory: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo","summary":"Duplicate Advisory: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo","severity":"medium","cvss":5.8,"cwe":["CWE-862"],"vendor":"siyuan-note","product":"github.com/siyuan-note/siyuan/kernel","ecosystem":"go","affected":["github.com/siyuan-note/siyuan/kernel < 3.7.4"],"published":"2026-08-12","updated":"2026-09-08","sourceUpdated":"2026-09-08T17:54:00Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mxjf-vfmv-qfm6","references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72790"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getnotebookinfo"},{"url":"https://github.com/advisories/GHSA-mxjf-vfmv-qfm6"}],"tags":["ghsa","go"],"ingestedAt":"2026-09-08T19:08:49.635Z","slug":"GHSA-mxjf-vfmv-qfm6","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-74pj-6g7r-j55c. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.\n\n## Affected packages\n\n- `github.com/siyuan-note/siyuan/kernel < 3.7.4`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}