SiYuan versions up to and including v3.7.2 have an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint. This endpoint returns PDF annotation content without enforcing publish-access checks, allowing unauthorized access to private annotations of forbidden, password-protected, or unpublished documents. The vulnerability does not expose annotations in encrypted notebooks. It was fixed in version v3.7.4.