This vulnerability exposes a structural failure in how SiYuan's API handles the boundary between authentication and authorization. The CheckAuth middleware verifies that a session is valid, but it was registered for handlers that perform resource-level operations without enforcing resource-level permissions. This is the core problem: authentication middleware functioning as a proxy for authorization—a common architectural shortcut when access-control ownership is ambiguous across a codebase.
The specific manifestation is a response side-channel. Anonymous callers probing the API receive different signals depending on document access tier: public documents return one behavior, password-protected documents another, and hidden or forbidden tiers produce yet other responses. These differences—varying Set-Cookie headers, message content, and potentially timing—exist because different code paths handle different tiers, and none were written with the assumption that an anonymous, unauthorized caller would be observing. The presence of hidden and forbidden tiers that store empty passwords is the exploitable condition: 'no password' became a proxy for 'restricted access' in the data model, creating a probe where empty credentials distinguish these tiers from non-existent documents.
The fix that likely shipped in v3.7.4 is probably a localized 401 wrapper added to the handler registration, or possibly endpoint removal. This stops the observable signal but leaves the underlying data model assumption intact—that empty password fields encode access restrictions. Audit your API surface for other endpoints registered with CheckAuth that perform resource operations without their own resource-level authorization checks. The four-tier access model (public, password-protected, hidden, forbidden) itself suggests architectural drift: tiers were added over time without refactoring the underlying access-control logic to handle them consistently. The response behavioral differences may persist even after authorization checks are added; treat the side-channel and the auth bypass as distinct vulnerabilities requiring separate remediation. The CVSS 5.8 rating understates this: the disclosure is document existence across access tiers, which functions as an oracle for intelligence gathering—attackers can enumerate hidden and forbidden documents and target them with follow-on exploitation.