Kernel: Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers

SiYuan versions <=3.7.2 contain an information disclosure vulnerability (CWE-862) in the getEncryptedNotebookStatus endpoint. This endpoint returns encrypted notebook identifiers, names, and lock states without enforcing publish-access filtering. As a result, anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their live unlock status, revealing sensitive information about notebook names and their decryption state in memory. The advisory is a duplicate of GHSA-f2rw-w22v-54vh and has been withdrawn accordingly. The vulnerability has a CVSS 3.1 base score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), reflecting a network-exploitable, low-complexity information disclosure with no integrity or availability impact but with scope change.

An attacker without authentication can obtain sensitive information about all encrypted notebooks, including their names and whether they are currently unlocked. This information disclosure could aid further targeted attacks or privacy violations. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory GHSA-f2rw-w22v-54vh for current remediation guidance. Since this advisory is a duplicate and withdrawn, the authoritative advisory should be consulted for patch availability and mitigation steps.