Threats Tagged 'ghsa-pf8f-99x6-h9q4'

SiYuan note-taking software versions prior to 3.8.2 contain an information disclosure vulnerability in the POST /api/transactions/undoState endpoint. This flaw allows an authenticated reader with knowledge of a visible document's root ID to retrieve internal root IDs of other documents modified in the same transaction, including private or unpublished ones. The vulnerability does not expose document content directly but reveals internal identifiers and cross-document relationships. The issue was fixed in version 3.8.2.