{"metadata": {"vulnerability": "cve-2026-73609", "count": 18, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-07-29T00:00:00Z", "date_only": false, "value": "2026-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-13T11:15:12.096Z", "date_only": false, "value": "2026-08-13T11:15:12.096Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-73609", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-13T11:28:13.793Z", "date_only": false, "value": "2026-08-13T11:28:13.793Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-73609", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-13T12:17:25Z", "date_only": false, "value": "2026-08-13T12:17:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7V6H-J59W-8QFP", "record": "GHSA-7V6H-J59W-8QFP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-13T12:17:25.463Z", "date_only": false, "value": "2026-08-13T12:17:25.463", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73609", "record": "FKIE_CVE-2026-73609", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-13T12:31:10Z", "date_only": false, "value": "2026-08-13T12:31:10Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7V6H-J59W-8QFP", "record": "GHSA-7V6H-J59W-8QFP", "field": "published"}, {"timestamp": "2026-08-14T16:52:34.095Z", "date_only": false, "value": "2026-08-14T16:52:34.095Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-14T18:30:14.092Z", "date_only": false, "value": "2026-08-14T18:30:14.092826Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-73609", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-14T18:30:14.092Z", "date_only": false, "value": "2026-08-14T18:30:14.092826Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73609", "record": "FKIE_CVE-2026-73609", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-14T20:18:31.189Z", "date_only": false, "value": "2026-08-14T20:18:31.189Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-73609", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-14T20:18:31.189Z", "date_only": false, "value": "2026-08-14T20:18:31.189Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-73609", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-01T16:23:22Z", "date_only": false, "value": "2026-10-01T16:23:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7V6H-J59W-8QFP", "record": "GHSA-7V6H-J59W-8QFP", "field": "modified"}, {"timestamp": "2026-10-01T16:23:22Z", "date_only": false, "value": "2026-10-01T16:23:22Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-7V6H-J59W-8QFP", "record": "GHSA-7V6H-J59W-8QFP", "field": "withdrawn"}, {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J4PH-9XWF-WCJ4", "record": "GHSA-J4PH-9XWF-WCJ4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "record": "CVE-2026-73609", "field": "creation_timestamp", "uuid": "10bfa52c-a622-4165-b2c3-028636e98084", "url": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J4PH-9XWF-WCJ4", "record": "GHSA-J4PH-9XWF-WCJ4", "field": "modified"}, {"timestamp": "2026-10-01T20:30:31Z", "date_only": false, "value": "2026-10-01T20:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/78ce2182a966596104e43c4f25489270", "record": "CVE-2026-73609", "field": "creation_timestamp", "uuid": "c7d3500b-2d38-4297-ba09-00cdd8cffea5", "content": "# CVE-2026-73609: CVE-2026-73609: Missing Authorization in SiYuan Note getBookmarkLabels Endpoint\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73609\n\n## Summary\nAn information disclosure vulnerability (CWE-862) in the SiYuan Note platform before version v3.7.4 allows anonymous or unprivileged readers to obtain a complete list of bookmark labels globally across all workspaces and notebooks by querying the `/api/attr/getBookmarkLabels` API endpoint.\n\n## TL;DR\nMissing authorization checks on the `/api/attr/getBookmarkLabels` endpoint in SiYuan Note allow unauthenticated or unprivileged users to query and retrieve all bookmark labels across the entire workspace, exposing confidential project names, structures, and metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.8\n- **CVSS v4.0**: 6.9\n- **EPSS Score**: 0.00325 (0.33%)\n- **Exploit Status**: Conceptual Proof of Concept\n\n## Affected Systems\n\n- SiYuan Note\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or later\n- Bind Siyuan Note server strictly to localhost loopback interface (127.0.0.1)\n- Restrict endpoint access using Nginx or other reverse proxies to filter path /api/attr/getBookmarkLabels\n\n**Remediation Steps:**\n1. Identify the current running version of Siyuan Note.\n2. Download the updated version (v3.7.4 or later) from the official GitHub repository.\n3. Apply the update and restart the server.\n4. Validate the fix by attempting an unauthenticated POST request to /api/attr/getBookmarkLabels.\n\n## References\n\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-73609)\n- [GitHub Security Advisory (GHSA)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73609) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/78ce2182a966596104e43c4f25489270"}, {"timestamp": "2026-10-24T15:10:00.190Z", "date_only": false, "value": "2026-10-24T15:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73609", "record": "FKIE_CVE-2026-73609", "field": "lastModified"}], "metrics": {"as_of": "2026-10-30T19:56:41.480Z", "anchors": {"origin": {"timestamp": "2026-07-29T00:00:00Z", "date_only": false, "value": "2026-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-29T00:00:00Z", "date_only": false, "value": "2026-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "record": "CVE-2026-73609", "field": "creation_timestamp", "uuid": "10bfa52c-a622-4165-b2c3-028636e98084", "url": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 5588617.0, "hours": 1552.393611111111, "days": 64.68306712962963, "min_seconds": 5502217.0, "max_seconds": 5588617.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-29T00:00:00Z", "date_only": false, "value": "2026-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "record": "CVE-2026-73609", "field": "creation_timestamp", "uuid": "10bfa52c-a622-4165-b2c3-028636e98084", "url": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8107001.480884, "hours": 2251.944855801111, "days": 93.83103565837963, "min_seconds": 8020601.480884, "max_seconds": 8107001.480884, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-29T00:00:00Z", "date_only": false, "value": "2026-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-73609", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T19:56:41.480Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 2518384.480884, "hours": 699.5512446900001, "days": 29.147968528750003, "min_seconds": 2518384.480884, "max_seconds": 2518384.480884, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-01T16:23:37Z", "date_only": false, "value": "2026-10-01T16:23:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "record": "CVE-2026-73609", "field": "creation_timestamp", "uuid": "10bfa52c-a622-4165-b2c3-028636e98084", "url": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-30T19:56:41.480Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}