https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:17:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-72790 <p>SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.</p> <p>SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.</p> https://db.gcve.eu/vuln/fkie_cve-2026-72790 https://db.gcve.eu/vuln/ghsa-74pj-6g7r-j55c <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72790](https://nvd.nist.gov/vuln/detail/CVE-2026-72790).</p> <p>### Relationship to GHSA-8x84-r2ff-h8pq (please read first)</p> <p>`getNotebookInfo` is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both `getNotebookConf` and `getNotebookInfo`. Commit `3bc014c7d` applied that filtering to `getNotebookConf` only.</p> <p>That advisory grouped `getNotebookInfo` under `BoxCrypt`, and `getNotebookInfo` never returns `BoxCrypt`. Anyone checking the handler for key material would correctly find none and move on. This report corrects that characterisation and states what the handler actually discloses, which is notebook metadata rather than key material. If you would prefer this tracked as a follow-up on the original advisory rather than separately, that is entirely reasonable.</p> <p>### Summary</p> <p>`/api/notebook/getNotebookInfo` is registered with `CheckAuth` only and applies no authorization check of any kind. Given a notebook identifier, it returns that notebook&#39;s author-written name, document count, total size and creation and modification timestamps. It does so for every notebook the server has loaded, including notebooks that `lsNotebooks` deliberately withholds from readers because they are closed or not publish-visible.</p> <p>### Details</p> <p>| Item | Detail | |---|---| | Route | `kernel/api/router.go:123` `POST /api/notebook/getNotebookInfo` → `model.CheckAuth` → `getNotebookInfo` | | Mid…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72790](https://nvd.nist.gov/vuln/detail/CVE-2026-72790).</p> <p>### Relationship to GHSA-8x84-r2ff-h8pq (please read first)</p> <p>`getNotebookInfo` is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both `getNotebookConf` and `getNotebookInfo`. Commit `3bc014c7d` applied that filtering to `getNotebookConf` only.</p> <p>That advisory grouped `getNotebookInfo` under `BoxCrypt`, and `getNotebookInfo` never returns `BoxCrypt`. Anyone checking the handler for key material would correctly find none and move on. This report corrects that characterisation and states what the handler actually discloses, which is notebook metadata rather than key material. If you would prefer this tracked as a follow-up on the original advisory rather than separately, that is entirely reasonable.</p> <p>### Summary</p> <p>`/api/notebook/getNotebookInfo` is registered with `CheckAuth` only and applies no authorization check of any kind. Given a notebook identifier, it returns that notebook&#39;s author-written name, document count, total size and creation and modification timestamps. It does so for every notebook the server has loaded, including notebooks that `lsNotebooks` deliberately withholds from readers because they are closed or not publish-visible.</p> <p>### Details</p> <p>| Item | Detail | |---|---| | Route | `kernel/api/router.go:123` `POST /api/notebook/getNotebookInfo` → `model.CheckAuth` → `getNotebookInfo` | | Mid…</p> https://db.gcve.eu/vuln/ghsa-74pj-6g7r-j55c