CVE-2026-73607 describes an information disclosure vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability exists because the /api/storage/getOutlineStorage API endpoint lacks authorization checks, enabling unauthenticated attackers to access outline state information such as heading identifiers for any document by providing its identifier. This can expose document structure details that should be restricted. No official patch or remediation guidance is currently confirmed.

Attackers can retrieve outline state information for any document, including those that should be inaccessible, potentially exposing sensitive document structure metadata. However, the vulnerability does not allow modification or deletion of data, nor does it disclose document content directly. The CVSS score of 6.9 reflects a medium impact primarily due to unauthorized information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint where possible and monitor for unauthorized access attempts. Avoid exposing document identifiers publicly to reduce risk.