Threats Tagged 'ghsa-fv97-ww8v-fw2w'

SiYuan versions up to 3.8.1 have an authorization bypass vulnerability in the /api/file/getFile endpoint. This flaw allows users with reader roles to access files from notebooks that are explicitly set as not visible (Visible:false). By knowing the hidden notebook identifier and file path, attackers can retrieve private workspace files, including notebook metadata and internal configuration.