What is GHSA-f68g-4xv8-2g75?

GHSA-f68g-4xv8-2g75 is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password

Why does GHSA-f68g-4xv8-2g75 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-f68g-4xv8-2g75?

GHSA-f68g-4xv8-2g75 has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

Which products are affected by GHSA-f68g-4xv8-2g75?

GHSA-f68g-4xv8-2g75 affects 1 product, including: go/github.com/siyuan-note/siyuan/kernel:\u003c= 3.7.3.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 4, 2026

GHSA-f68g-4xv8-2g75MediumCVSS 5.8Disclosed before NVD

Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

September 4, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mp7r-57w4-5qm3. This link is maintained to preserve external references.

Original Description

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password.

🎯 Affected products1

go/github.com/siyuan-note/siyuan/kernel:<= 3.7.3

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)