CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-46745"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-12T17:15:48Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated user without user-management permissions could view other users\u0027 account information.",
  "id": "GHSA-7497-r7g9-h259",
  "modified": "2025-05-12T18:31:48Z",
  "published": "2025-05-12T18:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46745"
    },
    {
      "type": "WEB",
      "url": "https://selinc.com/products/software/latest-software-versions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T21:15:46Z",
    "nvd_published_at": "2019-10-16T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.",
  "id": "GHSA-74c2-965q-mqjw",
  "modified": "2024-01-30T21:15:46Z",
  "published": "2022-05-24T16:58:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10457"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/10/16/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3663"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-22T07:15:13Z",
    "severity": "MODERATE"
  },
  "details": "The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in all versions up to, and including, 5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary pages and posts.",
  "id": "GHSA-74c3-rgpv-v3qr",
  "modified": "2026-04-08T18:33:13Z",
  "published": "2024-05-22T09:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3663"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-scraper/trunk/wp-scraper.php#L1426"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3095663%40wp-scraper\u0026new=3095663%40wp-scraper\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4bc52d-5771-4e7b-a394-772f2a5edbd7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-04T16:15:32Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar: from n/a through 5.9.4.",
  "id": "GHSA-74cg-qw7q-36rg",
  "modified": "2026-04-01T18:34:32Z",
  "published": "2025-04-04T18:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32235"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-music-player-podcast-player-radio-by-sonaar-plugin-5-9-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-35726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-10T08:15:50Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.19.",
  "id": "GHSA-74f6-jvr9-qch3",
  "modified": "2024-06-10T09:31:05Z",
  "published": "2024-06-10T09:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35726"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-19-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-39073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-12T22:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.",
  "id": "GHSA-74gh-jx2r-2377",
  "modified": "2024-04-04T07:38:35Z",
  "published": "2023-09-13T00:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39073"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ph4nt0mbyt3/9456312e867c10de8f808250ec0b12d3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639",
      "CWE-862",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T17:01:53Z",
    "nvd_published_at": "2026-07-09T17:17:02Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAn authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside **another** user\u0027s authenticated session. The Socket.IO event-caller (`get_event_call`) delivers `execute:python` / `execute:tool` events to a **client-supplied** `session_id` after only checking that the session is connected, never that it belongs to the requester. Combined with `ydoc:document:join`, which exposes the live socket ids of everyone in a shared note\u0027s collaboration room to any read-access participant, an attacker can target a victim\u0027s session and run attacker-chosen code/tools in the victim\u0027s browser context. When the victim is an administrator, that hijacked context reaches the admin-only Functions API, whose source is executed server-side, yielding remote code execution as the server process (root in the default container).\n\n## Affected component\n\n- `backend/open_webui/socket/main.py` \u2014 `get_event_call()` / `__event_caller__`\n- `backend/open_webui/main.py` \u2014 chat-completion metadata (`session_id` taken from the request body)\n\n## Root cause\n\nThe event-caller routes to a caller-controlled session id with no ownership check:\n\n```python\n# backend/open_webui/socket/main.py \u2014 get_event_call()\nasync def __event_caller__(event_data):\n    session_id = request_info[\u0027session_id\u0027]\n    if session_id not in SESSION_POOL:                 # only checks the session is connected\n        return {\u0027error\u0027: \u0027Client session disconnected.\u0027}\n    return await sio.call(\u0027events\u0027, {...}, to=session_id, ...)   # delivered to that sid\n```\n\n`session_id` originates from the request body and is never validated against the authenticated user:\n\n```python\n# backend/open_webui/main.py\nmetadata = {\n    \u0027user_id\u0027: user.id,                               # server-derived (trustworthy)\n    \u0027session_id\u0027: form_data.pop(\u0027session_id\u0027, None),  # client-controlled\n    ...\n}\n```\n\n`SESSION_POOL[session_id]` is the user record of whoever owns that socket. Because the caller checks only membership (`in SESSION_POOL`), a request carrying another user\u0027s `session_id` causes `execute:python` / `execute:tool` to be delivered to that other user\u0027s browser.\n\n## Reachability\n\n- `execute:python` / `execute:tool` are emitted from the code-interpreter and tool-call paths (`utils/middleware.py`, `tools/builtin.py`), all routed through `get_event_call`.\n- The victim\u0027s live `session_id` is disclosed to any read-access participant of a shared note via `ydoc:document:join`.\n- `POST /api/v1/chat/completions` requires only `get_verified_user` (the default user role). The attacker uses their own account and a model / Direct Connection they control to choose the payload.\n\n## Impact\n\n- **Any victim:** arbitrary code-interpreter Python and tool execution in the victim\u0027s authenticated session \u2014 the attacker acts with the victim\u0027s identity and origin (full session/account compromise).\n- **Admin victim:** the hijacked admin context reaches `POST /api/v1/functions/create`, whose source is `exec()`\u0027d server-side \u2192 remote code execution as the server process (root in the default container).\n\nThe Functions API is intended administrator code-execution; the vulnerability here is the cross-user delivery that lets an attacker drive another user\u0027s session \u2014 including an admin\u0027s \u2014 into it. The primitive is a full session compromise even against non-admin victims.\n\n## Proof of Concept\n\nThe reporter\u0027s `exploit.py` reproduced on `ghcr.io/open-webui/open-webui:0.9.6` and a build of the `v0.9.6` tag, confirming blind server-side RCE out-of-band (callback returns `uid=0(root)`), using only a low-privilege `user` account that shared a note with an admin victim. Preconditions: code interpreter enabled; attacker shares a note with the victim; victim opens it while online; admin victim required for server RCE.\n\n## Fix\n\n`get_event_call` must verify the target session belongs to the requesting user before delivering, not merely that it is connected:\n\n```python\nsession = SESSION_POOL.get(session_id)\nif session is None or session.get(\u0027id\u0027) != request_info.get(\u0027user_id\u0027):\n    return {\u0027error\u0027: \u0027Client session disconnected.\u0027}\n```\n\n`user_id` in the request metadata is server-derived from the authenticated user, so it is trustworthy. Restricting `ydoc:document:join` so it does not disclose other participants\u0027 socket ids is recommended as defence-in-depth.\n\n## Affected / Patched\n\n- Affected: `\u003c 0.10.0` (last affected release 0.9.6)\n- Patched: v0.10.0. `get_event_call` now verifies the target session belongs to the requesting user before delivering (`session is None or session.get(\u0027id\u0027) != request_info.get(\u0027user_id\u0027)`), using the server-derived `user_id` from the request metadata. The recommended `ydoc:document:join` sid-disclosure restriction is defence-in-depth and independent of this fix; the ownership check closes the cross-user delivery regardless of whether the victim\u0027s sid is known.",
  "id": "GHSA-74h3-cxq7-vc5q",
  "modified": "2026-07-24T17:01:53Z",
  "published": "2026-07-24T17:01:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59216"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/25763"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/386ac958144dbbbf0aa6e268070d72b681a318aa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-04T04:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.",
  "id": "GHSA-74jf-25c2-5jf2",
  "modified": "2024-01-04T06:30:32Z",
  "published": "2024-01-04T06:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6733"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3015224%40wp-members%2Ftrunk\u0026old=2920897%40wp-members%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/46c61f38-553e-43b2-a666-b160db40e66d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-112823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-20T16:17:03Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.",
  "id": "GHSA-74mv-xh25-c55c",
  "modified": "2026-10-20T18:31:43Z",
  "published": "2026-10-20T18:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112823"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-25-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260726005141-9edb321eb451"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T17:54:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**CVE:** This vulnerability corresponds to [CVE-2026-72790](https://nvd.nist.gov/vuln/detail/CVE-2026-72790).\n\n### Relationship to GHSA-8x84-r2ff-h8pq (please read first)\n\n`getNotebookInfo` is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both `getNotebookConf` and `getNotebookInfo`. Commit `3bc014c7d` applied that filtering to `getNotebookConf` only.\n\nThat advisory grouped `getNotebookInfo` under `BoxCrypt`, and `getNotebookInfo` never returns `BoxCrypt`. Anyone checking the handler for key material would correctly find none and move on. This report corrects that characterisation and states what the handler actually discloses, which is notebook metadata rather than key material. If you would prefer this tracked as a follow-up on the original advisory rather than separately, that is entirely reasonable.\n\n### Summary\n\n`/api/notebook/getNotebookInfo` is registered with `CheckAuth` only and applies no authorization check of any kind. Given a notebook identifier, it returns that notebook\u0027s author-written name, document count, total size and creation and modification timestamps. It does so for every notebook the server has loaded, including notebooks that `lsNotebooks` deliberately withholds from readers because they are closed or not publish-visible.\n\n### Details\n\n| Item | Detail |\n|---|---|\n| Route | `kernel/api/router.go:123` `POST /api/notebook/getNotebookInfo` \u2192 `model.CheckAuth` \u2192 `getNotebookInfo` |\n| Middleware | `CheckAuth` only, no `CheckReadonly`, no `CheckAdminRole` |\n| Guard in handler | None. `IsReadOnlyRoleContext`, `publishAccess`, `Visible` and `Closed` all return zero matches |\n| Exposed | `BoxInfo{ID, Name, DocCount, Size, HSize, Mtime, CTime, HMtime, HCtime}` |\n| Affected refs | `eef105683` (v3.7.3, master HEAD) and `v3.7.4-alpha.1`, handler identical on both |\n\n**The handler.** It validates `boxID` against the ID pattern, calls `box := model.Conf.Box(boxID)`, returns a not-found response if that is nil, and otherwise returns `box.GetInfo()` unmodified. `GetInfo()` (`kernel/model/box.go:470`) walks the notebook\u0027s files and returns the metadata listed above. There is no ownership check and no publish-access check anywhere on the path.\n\nThe nil branch is also a minor existence oracle: a valid-format identifier that names no loaded notebook is distinguishable from one that does.\n\n**Guarded sibling.** `lsNotebooks`, the notebook lister, is also reader-reachable and does filter. For read-only roles it skips any notebook where `notebook.Closed` holds, and skips any notebook whose publish-access entry has `!item.Visible`. The codebase therefore intends closed and non-published notebooks to be invisible to readers. `getNotebookInfo` returns their name and statistics to any reader who supplies the identifier.\n\n**Precedent.** GHSA-f2rw-w22v-54vh restricted `getEncryptedNotebookStatus`, which disclosed encrypted-notebook names and lock state, to administrators. `getNotebookInfo` is the non-encrypted analogue, disclosing regular notebook names and statistics including for notebooks outside the reader\u0027s publish scope, and was not restricted.\n\n**Reachability, stated precisely, because it differs by branch.**\n\nOn v3.7.3 a reader can obtain the identifier of a notebook they cannot see, by chaining two endpoints that are currently ungated on that branch. `getBlockDefIDsByRefText` returns block and document identifiers workspace-wide, including from hidden notebooks. `getPathByID` then returns the owning notebook identifier for any such block, in its `notebook` field. `getFullHPathByID` additionally discloses the notebook name directly. The chain requires no special conditions beyond a reference text that occurs somewhere in the workspace.\n\nOn the development branch those sources are already closed. `getPathByID` now gates through `CheckBlockIdMetadataAccessableByPublishAccessInBox`, `getIDsByHPath` through `filterFileTreeBlockIDsByPublishDiscoverability`, and `getBlockDefIDsByRefText` and `getFullHPathByID` are likewise gated. Notebook identifiers are a fourteen-digit timestamp plus seven random characters, and `Conf.Box(boxID)` returns non-nil only for loaded notebooks, so guessing is not practical. A reader-reachable route on the development branch that yields the identifier of a hidden notebook was not found.\n\nSo on the development branch this is defence in depth rather than a live path. It is reported because the handler itself remains unguarded on both branches, and because closing it removes any dependence on those identifier sources staying gated in future.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. A notebook that is closed or not publish-visible. Steps 1 and 2 apply to v3.7.3; on the development branch, start at step 3 with a known identifier.\n\nStep 1, obtain block identifiers workspace-wide:\n\n```\nPOST http://127.0.0.1:6808/api/block/getBlockDefIDsByRefText\n{\"anchor\":\"\u003ca word likely to occur anywhere in the workspace\u003e\"}\n\n\u2192 200, block and document identifiers including ones inside hidden notebooks\n```\n\nStep 2, resolve one to its owning notebook:\n\n```\nPOST http://127.0.0.1:6808/api/filetree/getPathByID\n{\"id\":\"\u003cidentifier from step 1\u003e\"}\n\n\u2192 200, the notebook field carries the hidden notebook\u0027s boxID\n```\n\nStep 3, read the notebook\u0027s metadata:\n\n```\nPOST http://127.0.0.1:6808/api/notebook/getNotebookInfo\n{\"notebook\":\"\u003cboxID from step 2\u003e\"}\n\n\u2192 200, returns name, docCount, size, hSize, mtime, ctime, hMtime, hCtime\n   for a notebook that lsNotebooks does not return to this same session\n```\n\nThe differential is the point: call `lsNotebooks` with the same session and confirm the notebook is absent from the list, then call `getNotebookInfo` and receive its name and statistics.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, can read the author-written name, document count, total size and activity timestamps of notebooks that are closed or not published, which are exactly the notebooks the notebook lister withholds from them. Notebook names are free text chosen by the author and routinely describe their contents. Document count and size indicate scale, and the modification timestamp reveals recent activity in a workspace area the reader has no access to. Confidentiality only, with no integrity or availability impact, and no document content is disclosed.\n\n### Suggested fix\n\nApply the same filtering `lsNotebooks` already performs. When `IsReadOnlyRoleContext(c)` holds, return the not-found response unless the notebook is publish-visible and not closed, before calling `GetInfo()`. This is the reader filtering the earlier advisory\u0027s remediation section requested for this handler.",
  "id": "GHSA-74pj-6g7r-j55c",
  "modified": "2026-09-08T17:54:19Z",
  "published": "2026-09-08T17:54:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/9edb321eb451db445f3c824380e1993c3df0fc16"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getnotebookinfo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo"
}