CVE-2026-103762 describes a missing authorization vulnerability in SiYuan note-taking software versions prior to 3.8.5. The affected endpoints—getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath—allow read-only publish visitors to POST any open notebook ID and receive the global save-box ID and save-path template. This behavior leaks information about unpublished notebooks, including their existence and creation timestamps, to unauthorized users. The vulnerability does not require privileges beyond read-only or anonymous publish access and does not involve privilege escalation or code execution.

Attackers with read-only or anonymous publish access can enumerate unpublished notebooks by learning their box IDs and creation times. This information disclosure could aid in further reconnaissance or privacy violations but does not directly enable modification or deletion of data. The CVSS 4.0 base score is 6.9, indicating a medium severity impact primarily due to information disclosure over a network with no authentication required.

A fix is available in SiYuan version 3.8.5 and later. Users should upgrade to version 3.8.5 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.