Executive brief
SiYuan is a note-taking and knowledge management application that supports publishing documents with granular access controls. Three API endpoints (`getHeadingDeleteTransaction`, `getHeadingLevelTransaction`, `getHeadingInsertTransaction`) return rendered document content without checking whether the document is marked publish-disabled by an administrator, allowing anonymous readers or low-privileged accounts to view sensitive content that should be hidden. An attacker who knows a heading's block ID can bypass content restrictions and read full document text from documents explicitly marked as not publishable.
Technical details
The vulnerability is a missing authorization check (CWE-862) in three heading transaction endpoints. These endpoints (`/api/block/getHeadingDeleteTransaction`, `/api/block/getHeadingLevelTransaction`, `/api/block/getHeadingInsertTransaction`) are gated only by `CheckAuth`, which permits both anonymous readers and RoleReader tokens in publish mode. Despite their mutation-implying names, these endpoints compute but do not execute transactions; they return rendered DOM of the heading subtree in the transaction payload without invoking the publish-access filter (`IsReadOnlyRoleContext`) that the reader-safe content path (`getDoc`) applies. An attacker with a heading block ID can extract full rendered HTML content from documents marked publish-disabled, defeating administrator-configured access boundaries. The precondition is knowledge of the target heading's block ID; when chained with other CheckAuth-only endpoints lacking publish-access filters, this enables end-to-end disclosure of publish-disabled documents. No write privilege, admin role, or CSRF token is required. Patched in version 0.0.0-20260721013353-69db783b782a.
Affected products
- SiYuan SiYuan before 0.0.0-20260721013353-69db783b782a
Timeline
- 2026-09-03: disclosed: GitHub Advisory GHSA-69mh-gvh4-8gp7 published
- 2026-07-21: patched: Fix released in version 0.0.0-20260721013353-69db783b782a (commit 69db783)