CVE-2026-85578

CVE-2026-85578 is an authorization bypass (CWE-862) in the /api/file/getFile endpoint of SiYuan, an open-source note-taking and knowledge-management application, affecting all versions through 3.8.1. An attacker holding a reader-role account can request files from notebooks that administrators marked as not visible (Visible:false) simply by supplying the hidden notebook's identifier and a file path, because the endpoint serves the file without enforcing the visibility setting. Successful exploitation grants read access to private workspace content, notebook metadata, and internal configuration files, but nothing is modified or deleted (integrity and availability impacts are none). Any SiYuan deployment on version 3.8.1 or earlier that grants access to reader-role users and relies on Visible:false to keep notebooks private is affected. There is no known public proof-of-concept, no CISA KEV listing, and no reported exploitation so far; EPSS estimates the 30-day exploitation probability at roughly 0.3%.

What to do: Upgrade SiYuan to a patched release newer than 3.8.1 as soon as one is available, and until then do not rely on Visible:false as a confidentiality control for notebooks shared with reader-role users. As interim mitigation, restrict or filter access to /api/file/getFile at a reverse proxy and audit server logs for reader-role requests referencing hidden notebook identifiers or sensitive paths such as configuration files.