CVE-2026-73048 lets attackers query the SiYuan API with a publicly visible annotation ID and retrieve block identifiers from documents the attacker has no permission to access. The CVSS 5.8 score is misleading: the real threat isn't the block IDs leaked, but the structural inference attack this enables. Each annotation ID functions as a pivot key across permission boundaries—an attacker chains multiple public annotation IDs to map the topology of restricted documents without ever accessing them. In SiYuan's block-based architecture, discovering that specific restricted blocks cite a particular PDF annotation reveals concrete information about intellectual structure: subject matter, relationships to source material, logical dependencies. This is reconnaissance with compounding returns, not direct exfiltration.
The 3.7.4 patch adds publish-access filtering to the returned block list, which stops the most obvious pivot. However, the underlying authorization flaw persists: the endpoint authorizes based on annotation visibility, not block ownership—a category error where one permission dimension proxies for an unrelated one. Response length, timing differences, or even consistent empty-versus-populated responses can still confirm existence of restricted documents referencing specific annotations.
Beyond the patched vector, audit for orphaned annotation IDs: identifiers from deleted or downgraded documents may remain valid query keys, enabling attacks without any current public page as a starting point. The annotation ID namespace likely retains historical artifacts that outlive their authorization context. Examine adjacent endpoints for similar cross-dimensional authorization patterns—where visibility of resource A implicitly grants metadata access to resource B. This vulnerability's severity lies in what it reveals about restricted knowledge structures, not what it directly exfiltrates.