https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:41:42 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-73607 <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.</p> <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-73607 https://vulnerability.circl.lu/vuln/ghsa-53fp-9jmv-227g <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/storage/getOutlineStorage` is registered with `CheckAuth` only and performs no authorization of any kind. Given a document identifier it returns that document&#39;s stored outline state, regardless of the document&#39;s publish tier.</p> <p>The two write endpoints for the same data, `setOutlineStorage` and `removeOutlineStorage`, both carry `CheckAdminRole` and `CheckReadonly`. Only the read path is unguarded.</p> <p>### Details</p> <p>**Routes.** `kernel/api/router.go:103` on master, `:108` on the development branch:</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/getOutlineStorage&#34;, model.CheckAuth, getOutlineStorage) ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/setOutlineStorage&#34;, model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setOutlineStorage) ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/removeOutlineStorage&#34;, model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeOutlineStorage) ```</p> <p>**Handler.** `kernel/api/storage.go:466` on the development branch, `:469` on master, identical. It binds `docID` and calls `model.GetOutlineStorage(docID)`, which iterates the stored outline documents and returns the entry whose `DocID` matches. There is no filter function on this path at all: no `*gin.Context`, no publish-access check, no password check, no visibility check. The caller supplies the identifier and receives the payload.</p> <p>**What is stored.** `type OutlineDoc { DocID string; Data map[string]any }`. The client writes it from `app/src/layout/dock/Outline.ts:742`:</p> <p>```…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/storage/getOutlineStorage` is registered with `CheckAuth` only and performs no authorization of any kind. Given a document identifier it returns that document&#39;s stored outline state, regardless of the document&#39;s publish tier.</p> <p>The two write endpoints for the same data, `setOutlineStorage` and `removeOutlineStorage`, both carry `CheckAdminRole` and `CheckReadonly`. Only the read path is unguarded.</p> <p>### Details</p> <p>**Routes.** `kernel/api/router.go:103` on master, `:108` on the development branch:</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/getOutlineStorage&#34;, model.CheckAuth, getOutlineStorage) ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/setOutlineStorage&#34;, model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setOutlineStorage) ginServer.Handle(&#34;POST&#34;, &#34;/api/storage/removeOutlineStorage&#34;, model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeOutlineStorage) ```</p> <p>**Handler.** `kernel/api/storage.go:466` on the development branch, `:469` on master, identical. It binds `docID` and calls `model.GetOutlineStorage(docID)`, which iterates the stored outline documents and returns the entry whose `DocID` matches. There is no filter function on this path at all: no `*gin.Context`, no publish-access check, no password check, no visibility check. The caller supplies the identifier and receives the payload.</p> <p>**What is stored.** `type OutlineDoc { DocID string; Data map[string]any }`. The client writes it from `app/src/layout/dock/Outline.ts:742`:</p> <p>```…</p> https://vulnerability.circl.lu/vuln/ghsa-53fp-9jmv-227g