SiYuan versions prior to v3.7.3 contain an information disclosure vulnerability affecting the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction API endpoints. These endpoints return rendered block DOM content without enforcing publish-access checks. As a result, anonymous users or those with publish RoleReader tokens can supply a heading block ID to read the full rendered content of documents that have publish access disabled. This bypass allows unauthorized access to restricted content that should not be publicly available. The vulnerability requires no authentication beyond a valid heading block ID, making it relatively easy to exploit. It affects the confidentiality of private or restricted notes and documents stored in SiYuan. Users are advised to upgrade to v3.7.3 or later to remediate this issue.