SiYuan before version 3.7.4 contains an access control bypass vulnerability where static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or anonymous access in disabled-auth mode to read templates, snippets, and export artifacts by directly accessing static routes that lack the same restrictions as the REST API. The advisory is a duplicate and has been withdrawn in favor of GHSA-fgmr-7w36-9qfq. No patch links are provided in this data.