A missing authorization vulnerability in SiYuan versions prior to 3.7.3 allows unauthenticated remote attackers to access sensitive information, posing a significant risk to data confidentiality.

The software suffers from a missing authorization flaw (CWE-862) in its transaction handling, which permits unauthenticated users to perform unauthorized actions or retrieve restricted data.

Successful exploitation of this vulnerability allows unauthorized access to sensitive application data, which could lead to significant information disclosure. With a CVSS score of 8.6, this flaw is considered high severity, as it permits remote, unauthenticated access to potentially private notes and system configurations.

Immediate Action: Upgrade SiYuan to version 3.7.3 or later to apply the necessary authorization checks.

Proactive Monitoring: Inspect application and server access logs for anomalous GET requests or unusual transaction patterns originating from unauthorized IP addresses.

Compensating Controls: Implement network-level access controls or a Web Application Firewall to restrict access to the SiYuan interface to trusted internal networks only.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, administrators should prioritize updating to version 3.7.3 immediately. Failure to patch leaves the system exposed to unauthorized data extraction by remote, unauthenticated actors.