CVE-2026-73609 describes a missing authorization vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability exists in the getBookmarkLabels endpoint, which returns all bookmark labels in the workspace without enforcing publish-access filtering. This allows unauthorized users, including anonymous and publish-mode readers, to obtain the full bookmark vocabulary across the workspace. The exposure can disclose sensitive subject matter and organizational information from documents that are otherwise inaccessible to these users.

Unauthorized users can access bookmark labels that reveal information about the content and organization of documents they do not have permission to view. This leads to information disclosure, potentially compromising confidentiality of workspace data. The vulnerability does not require privileges or user interaction and has a medium severity rating with a CVSS 4.0 base score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.7.4, upgrading to version 3.7.4 or later is likely recommended once official guidance is available. Until then, restrict access to the affected endpoint or workspace where possible to limit exposure.