CVE-2026-73606 is an information disclosure vulnerability affecting SiYuan note-taking software prior to version 3.7.4. The issue exists in the /api/block/getRefIDs endpoint, which does not properly enforce access controls on password-protected document tiers. As a result, unauthenticated users can query this endpoint to obtain block identifiers referenced by password-protected documents without authentication or password entry, potentially exposing sensitive metadata about protected content.

The vulnerability allows unauthenticated attackers to gain information about the structure and references within password-protected documents by retrieving block identifiers. Although the actual content of the protected documents is not disclosed, this metadata exposure could assist attackers in further reconnaissance or targeted attacks against the protected data. The CVSS 4.0 base score is 6.9, indicating a medium severity impact primarily due to information disclosure without authentication required.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor vendor communications for updates and apply any future patches promptly.