A critical authorization flaw in SiYuan allows unauthenticated remote attackers to bypass password requirements and access sensitive, bookmarked document content.

The vulnerability exists in the publish service, specifically within the /api/bookmark/getBookmark endpoint, where improper handling of a null context causes the application to skip required authorization checks. This allows any unauthenticated visitor to retrieve bookmarked blocks from documents that are intended to be password protected.

Successful exploitation of this vulnerability leads to unauthorized disclosure of sensitive information stored within private knowledge base documents. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to data confidentiality, potentially resulting in the compromise of proprietary, personal, or sensitive organizational data.

Immediate Action: Upgrade the SiYuan kernel to version 3.6.2 or later to resolve the authorization logic error.

Proactive Monitoring: Review access logs for the /api/bookmark/getBookmark endpoint to identify unusual request patterns or high volumes of unexpected access from external IP addresses.

Compensating Controls: Implement network-level access controls or a Web Application Firewall (WAF) to restrict external access to the SiYuan publish service until the software can be patched.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the confidentiality of stored information due to the ease of exploitation by unauthenticated actors. Organizations utilizing SiYuan in a published or read-only mode should prioritize upgrading to version 3.6.2 immediately to close this authorization gap and prevent potential data exfiltration.