Executive brief
SiYuan is a popular note-taking and knowledge management application that supports publishing documents for sharing with readers. When published documents contain embedded queries (transclusions) that pull content from other blocks, the API endpoints handling these embeds fail to apply access control to the embedded content itself. This allows anonymous readers or any reader with limited access to view the full HTML content of blocks in private, hidden, or password-protected documents by requesting a publicly-shared document that happens to reference them via an embed query.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the block DOM retrieval endpoints. The affected routes are `POST /api/block/getBlockDOMWithEmbed` and `POST /api/block/getBlockDOMsWithEmbed` in `kernel/api/router.go`, which are gated only by `model.CheckAuth` middleware, allowing access by RoleReader tokens and anonymously when `Publish.Auth.Enable` is false. The leak occurs in the `resolveEmbedContentInBox` function (`kernel/model/block.go:976`), which processes NodeBlockQueryEmbed nodes, executes SQL queries to fetch matched blocks, and inlines their content HTML via `SetIALAttr("embed-content", ...)` without applying any `publishAccess` filtering. In contrast, the sibling endpoint `getEmbedBlock` correctly applies `FilterEmbedBlocksByPublishAccess` to the same query results. No authentication bypass is required; the attack exploits the published nature of the requested block (which passes the top-level gate) to reach unfiltered embedded content. The PoC demonstrates requesting a published block containing an embed query, which returns private block content in the response DOM. A patch has been released in version 0.0.0-20260725125659-1ca1c3c9d94b.
Affected products
- siyuan-note siyuan < 0.0.0-20260725125659-1ca1c3c9d94b
Timeline
- 2026-07-25: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-25: patched: Patch released in commit 1ca1c3c9d94b
- 2026-09-04: advisory: Advisory GHSA-h6w7-xxcf-w2mq and CVE-2026-72795 published