[ CVE-2026-74904 · Published 18 Aug 2026 ]
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
CVSS 7.5
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
[ Fixes ]Fixes and patches
- github.com/siyuan-note/siyuan/kernel 0.0.0-20260804015139-bd067a4fe9b2Fixed version · GitHub Advisories · go package github.com/siyuan-note/siyuan/kernel: upgrade to 0.0.0-20260804015139-bd067a4fe9b2 or later (affected < 0.0.0-20260804015139-bd067a4fe9b2)
[ Packages ]Affected open-source packages
- github.com/siyuan-note/siyuan/kernel goAffected < 0.0.0-20260804015139-bd067a4fe9b2 · fixed in 0.0.0-20260804015139-bd067a4fe9b2 · GHSA-4vpg-gwqq-w44c