Executive brief
SiYuan is a note-taking and knowledge management application with a publish mode that allows users to share documents with password protection. Multiple content-fetching API endpoints fail to enforce the password requirement, allowing an unauthenticated attacker to retrieve the full contents of password-protected documents through alternate API calls. An attacker can discover internal document block IDs from publicly-listed (but password-protected) documents and use those IDs to fetch full content without providing a password, completely defeating the document-level access control.
Technical details
The vulnerability is an authentication bypass (CWE-288) in SiYuan's publish-mode password enforcement. The primary content endpoint (getDoc) correctly enforces password checks via FilterContentByPublishAccess, but six other content-returning endpoints perform only basic authentication checks (CheckAuth) without invoking the password filter. These endpoints convert block IDs into rendered DOM content regardless of the containing document's protected status. The bypass is reachable because protected documents are intentionally publicly listed, so an attacker obtains the document root ID. Internal heading/block IDs are then leaked from the searchEmbedBlock endpoint, which filters content but retains block IDs in its response. An attacker can then call getHeadingChildrenDOM with a leaked block ID to retrieve the full rendered content of the protected document without a password. The attack has been reproduced end-to-end on live instances and requires no authentication, user interaction, or special privileges.
Affected products
- siyuan-note SiYuan < 0.0.0-20260721020826-2d069dce84a2
Timeline
- 2026-09-03: disclosed: Published to GitHub Advisory Database
- 2026-07-21: patched: Patch available in version 0.0.0-20260721020826-2d069dce84a2