CVE-2026-74906 is an authorization vulnerability in SiYuan note-taking software prior to version 3.7.4. The issue arises because eight publish-mode reader-facing endpoints filter results using a visibility list instead of a disabled list, which is the correct filter for restricting access. This misconfiguration allows anonymous visitors to discover and read content from documents that are explicitly marked as forbidden from publishing. The affected endpoints include search, backlink, asset content, saved criteria, recent documents, graph, and tag functionalities.

Unauthorized anonymous users can access and read content from documents that should be restricted from publishing. This leads to a confidentiality breach of sensitive or restricted information. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating it is exploitable remotely without authentication and requires no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.7.4, upgrading to version 3.7.4 or later is likely to address the issue once the vendor releases an official fix. Until then, restrict access to affected endpoints or disable publish-mode reader-facing features if possible.