SiYuan before version 3.7.4 has an information disclosure vulnerability where the /api/tag/getTag endpoint returns tag labels and occurrence counts from password-protected documents to unauthenticated users. This allows attackers to enumerate tag vocabulary and internal terminology without entering the document's password. The advisory is a duplicate and has been withdrawn in favor of GHSA-mp7r-57w4-5qm3. The vulnerability has a medium severity rating with a CVSS score of 5.8.