CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
Attackers with read-only access can discover hidden notebook IDs and creation times via unprotected save-path endpoints in SiYuan.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103762?
CVE-2026-103762 is a medium-severity missing authorization vulnerability in siyuan-note siyuan, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
Weakness: CWE-862
Which versions are affected by CVE-2026-103762?
How do I fix CVE-2026-103762?
No fix has been published for CVE-2026-103762 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-103762 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-103762 exists.
Sources
Also known as GHSA-2mrf-mx66-vv6g, GHSA-7234-66p2-jh2w.