Kernel: Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

SiYuan versions <=3.7.2 disclose sensitive cryptographic material related to encrypted notebooks via unauthenticated endpoints when in publish mode. Specifically, attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys. This information enables offline brute-force attacks on the master password without any rate limiting, increasing the risk of password compromise. The vulnerability is tracked as CWE-522 (Insufficiently Protected Credentials) and has a CVSS 3.1 score of 7.5 (High). There is no evidence of known exploits in the wild. The advisory is a duplicate of GHSA-8x84-r2ff-h8pq, and no patch links are provided in the data.

The vulnerability allows attackers to obtain key-derivation parameters and wrapped keys without authentication, enabling unlimited offline attempts to crack the master password. This compromises the confidentiality of encrypted notebooks but does not affect integrity or availability. Successful exploitation could lead to unauthorized access to encrypted user data.

Patch status is not yet confirmed — check the vendor advisory GHSA-8x84-r2ff-h8pq for current remediation guidance. Until an official fix is available, avoid using vulnerable versions in publish mode or restrict access to unauthenticated endpoints that expose key material. Monitor vendor communications for updates.