CVE-2026-73048 describes an information disclosure vulnerability in SiYuan note-taking software versions prior to v3.7.4. The vulnerability exists in the getRefIDsByFileAnnotationID API endpoint, which returns block identifiers referencing PDF annotations. Due to missing authorization checks, this endpoint does not enforce publish-access filtering, allowing attackers to extract block identifiers from documents that are otherwise restricted or password-protected. This leakage reveals citation relationships between publicly visible annotations and restricted content.

Attackers can leverage this vulnerability to gain insight into the structure and citation relationships of restricted or password-protected documents by querying annotation identifiers visible on published pages. This results in unauthorized information disclosure of metadata that may reveal sensitive document relationships, although the content of the restricted documents themselves is not directly exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor vendor communications for updates and apply any forthcoming patches promptly.