CVE-2026-85579: Authorization Bypass Through User-Controlled Key in siyuan-note siyuan

CVE-2026-85579 is an information disclosure vulnerability in SiYuan note-taking software affecting versions before 3.8.2. The vulnerability exists in the POST /api/transactions/undoState endpoint, which returns the peekMutatedRootIDs list from the global undo-log stack based on a caller-supplied root ID. The endpoint fails to apply publish-access visibility filtering, allowing an authenticated reader who knows a visible document's root ID to obtain internal root IDs of other documents modified in the same cross-document transaction, including private or unpublished documents. Document body contents are not disclosed. The vulnerability was confirmed in version 3.8.1 and fixed in 3.8.2.

An authenticated user with reader privileges can obtain internal root IDs of documents they should not have access to, including private or unpublished documents, by exploiting the undoState endpoint. This leads to information disclosure of internal identifiers and relationships between documents but does not expose the actual document content. The impact is limited to metadata disclosure rather than content compromise.

Upgrade SiYuan to version 3.8.2 or later, where this vulnerability has been fixed. Versions prior to 3.8.2 are affected. No other mitigation is indicated.