SiYuan note-taking software prior to version 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without requiring authentication if the --mode flag is not set to exactly 'prod'. This misconfiguration enables unauthorized access to debug endpoints such as /debug/pprof/heap, allowing attackers to extract sensitive in-memory secrets including AccessAuthCode and AI provider API keys. The vulnerability is identified as CVE-2026-74799 with a CVSS 4.0 score of 9.2, indicating a critical severity level. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Unauthorized attackers can access debug endpoints that expose sensitive in-memory data, including authentication codes and API keys, potentially leading to credential compromise and unauthorized use of AI provider services. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that SiYuan is run with the --mode flag set exactly to 'prod' to disable unauthenticated debug endpoints. Restrict network access to debug endpoints if possible.