CyberRota Analysis
AI-GeneratedThe vulnerability affects Siyuan versions prior to 3.8.2, specifically in the POST /api/search/fullTextSearchBlock endpoint, which inadvertently reveals unfiltered match counts for private content. This information disclosure allows unauthenticated users to infer the existence of hidden or unpublished documents based on search queries. Organizations using affected versions should prioritize patching to mitigate the risk of exposing sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.