CVE-2026-85579: SiYuan Information Disclosure Vulnerability

CVE-2026-85579 Overview

SiYuan, a self-hosted personal knowledge management application, contains an information disclosure vulnerability in the POST /api/transactions/undoState endpoint. The endpoint is accessible to authenticated readers and returns the peekMutatedRootIDs list from the global undo-log stack for any caller-supplied root ID. The response is not filtered against publish-access visibility rules. An authenticated reader who knows the root ID of a visible document can enumerate internal root IDs of other documents modified in the same cross-document transaction, including private or unpublished ones. Document body contents remain protected, but internal identifiers and cross-document relationships are exposed. The issue is confirmed in v3.8.1 and fixed in v3.8.2. It is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated readers can obtain root IDs of private or unpublished SiYuan documents by querying the undoState endpoint with a known visible document ID.

Affected Products

SiYuan versions prior to v3.8.2
SiYuan v3.8.1 (confirmed vulnerable)
Deployments exposing reader-accessible publish endpoints

Discovery Timeline

2026-09-04 - CVE-2026-85579 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85579

Vulnerability Analysis

SiYuan maintains a global undo-log stack that records mutations across documents. When multiple documents are edited in a single cross-document transaction, the stack retains the root IDs of every affected document. The POST /api/transactions/undoState endpoint exposes this stack through the peekMutatedRootIDs field for a caller-supplied root ID.

The endpoint enforces authentication but does not apply the publish-access visibility filter used by content-serving routes. As a result, any authenticated reader with access to at least one published document can query the endpoint using that document's root ID and receive the identifiers of all documents mutated in the same transaction. Document body contents are not returned, so the exposure is limited to metadata: internal identifiers and cross-document relationships.

Root Cause

The root cause is missing authorization on an object reference returned by a reader-accessible API. The handler trusts the supplied root ID and returns adjacent root IDs from the undo-log stack without re-checking each returned identifier against the caller's publish-access scope. This matches the pattern described in [CWE-639], where access control decisions rely on a user-controlled key without server-side enforcement per returned object.

Attack Vector

Exploitation requires network access, authentication as a reader, and knowledge of one visible document's root ID. The attacker sends a POST request to /api/transactions/undoState with the known root ID. The response includes peekMutatedRootIDs values that may reference private or unpublished documents modified in the same transaction. The attacker can repeat the request to map document relationships and enumerate hidden identifiers over time. No verified public proof-of-concept is available. See the GitHub Security Advisory GHSA-6gf8-q9ch-w732 and the VulnCheck Advisory on Siyuan for further technical detail.

Detection Methods for CVE-2026-85579

Indicators of Compromise

Repeated POST requests to /api/transactions/undoState from a single authenticated reader session.
Requests to /api/transactions/undoState referencing the same root ID with unusual frequency or from unexpected client IPs.
Access log entries showing reader accounts probing transaction and undo-related endpoints without corresponding editor activity.

Detection Strategies

Instrument the SiYuan reverse proxy or application log to capture the request path, authenticated principal, and root ID parameter for every call to /api/transactions/undoState.
Alert when a reader-role account issues more than a small threshold of undoState requests within a short interval.
Correlate undoState responses against publish-access ACLs to identify cases where returned root IDs fall outside the caller's visibility scope.

Monitoring Recommendations

Forward SiYuan HTTP access logs to a centralized log platform and retain request bodies where policy allows.
Track the SiYuan server version in configuration management and flag any host reporting a version earlier than v3.8.2.
Baseline normal reader behavior and monitor deviations in API endpoint distribution.

How to Mitigate CVE-2026-85579

Immediate Actions Required

Upgrade SiYuan to v3.8.2 or later on all publicly accessible instances.
Audit reader accounts and revoke any credentials that are no longer required.
Review recent access logs for calls to /api/transactions/undoState and investigate any unexpected activity.

Patch Information

The vendor released v3.8.2 to remediate the vulnerability by applying publish-access visibility filtering to the undoState response. Refer to the GitHub Security Advisory GHSA-6gf8-q9ch-w732 for release details and commit references.

Workarounds

Restrict network access to the SiYuan API using a reverse proxy that blocks the /api/transactions/undoState path for unauthenticated or reader-role requests until the upgrade is applied.
Limit reader account provisioning and require re-authentication for shared publish links.
Isolate SiYuan instances hosting sensitive private documents from broad public reader access.

bash

# Example nginx snippet to block the vulnerable endpoint prior to upgrade
location = /api/transactions/undoState {
    return 403;
}