Executive brief
SiYuan is a popular open-source note-taking application. The `/api/block/getBlockInfo` endpoint fails to check whether a user has permission to access a document, exposing the document's title, location, and other metadata for documents an administrator has explicitly marked as hidden from public view. An attacker with network access to a SiYuan publish server can infer the existence and titles of private documents if they obtain a block identifier from within those documents.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the `/api/block/getBlockInfo` API endpoint. The endpoint accepts a caller-supplied block ID, validates only its format, and returns the containing document's root metadata (box, path, rootID, rootTitle, rootChildID, rootIcon) with no `IsReadOnlyRoleContext` / publish-access filter applied. The equivalent endpoint `getDocInfo` implements the same access filter correctly, indicating the boundary is intentional but overlooked in `getBlockInfo`. Both endpoints are gated only by `CheckAuth`, making them reachable by anonymous users when publish auth is disabled and by publish `RoleReader` tokens. Exploitation requires a valid block ID from the target document; the endpoint does not enumerate arbitrary documents. The disclosed metadata is limited to document title and location metadata—not document content. The issue is fixed in version 0.0.0-20260721014951-ffde3b21eca4 by applying the same publish-access filter before returning metadata.
Affected products
- SiYuan SiYuan before 0.0.0-20260721014951-ffde3b21eca4
Timeline
- 2026-09-03: disclosed: Published to GitHub Advisory Database
- 2026-07-21: patched: Fix committed; patched version 0.0.0-20260721014951-ffde3b21eca4