GHSA-rchc-g58m-88jm

Source

https://github.com/advisories/GHSA-rchc-g58m-88jm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-rchc-g58m-88jm/GHSA-rchc-g58m-88jm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rchc-g58m-88jm

Withdrawn

2026-09-04T20:58:20Z

Published

2026-08-12T21:31:41Z

Modified

2026-09-04T21:15:06Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-f2rw-w22v-54vh. This link is maintained to preserve external references.

Original Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-04T20:58:20Z",
    "nvd_published_at":  "2026-08-12T20:17:51Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/siyuan-note/siyuan/kernel

Package

Name: github.com/siyuan-note/siyuan/kernel; View open source insights on deps.dev
Purl: pkg:golang/github.com/siyuan-note/siyuan/kernel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.7.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-rchc-g58m-88jm/GHSA-rchc-g58m-88jm.json"