SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

[ Description ]Official description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.

[ Fixes ]Fixes and patches

• github.com/siyuan-note/siyuan/kernel 0.0.0-20260812083335-251596fc0de2Fixed version · GitHub Advisories · go package github.com/siyuan-note/siyuan/kernel: upgrade to 0.0.0-20260812083335-251596fc0de2 or later (affected < 0.0.0-20260812083335-251596fc0de2)

[ Packages ]Affected open-source packages

• github.com/siyuan-note/siyuan/kernel goAffected < 0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2 · GHSA-j4ph-9xwf-wcj4

[ References ]References

• github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4vendor-advisory
• www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getbookmarklabelsthird-party-advisory