CVE-2026-73048
MEDIUM
NVD
CVSS Score
5.8
Severity
MEDIUM
Published
Aug 14, 2026
Vendor
unknown
Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers.