Executive brief
SiYuan is a note-taking and knowledge management application that supports publishing documents to readers while keeping others private. Five API endpoints that resolve document paths and IDs lack proper access controls, allowing anonymous users or unprivileged readers to enumerate the complete structure of private notebooks, folders, and document titles—including those marked hidden, password-protected, or excluded from publishing. Document titles are often sensitive (project names, personnel information, client identifiers), and this information disclosure can enable further attacks.
Technical details
The vulnerability is a missing authorization check (CWE-862) in five path-resolution endpoints of SiYuan's filetree API. These endpoints—getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath—accept arbitrary document IDs or hierarchical paths and resolve them without invoking CheckBlockIdAccessableByPublishAccess or related authorization functions. Although registered with CheckAuth, they do not validate whether the caller (anonymous user or publish RoleReader) has permission to access the specific document. An unauthenticated attacker can map the entire private document tree (all notebooks, folders, and document titles) and enumerate document IDs for hidden or password-protected content. Preconditions: publish mode enabled and either Publish.Auth.Enable set to false (allowing anonymous access) or the attacker holds a publish reader account. The suggested fix mirrors authorization applied in related endpoints (getRecentDocs, getCriteria, getLocalStorage) by adding CheckBlockIdAccessableByPublishAccess calls. A patch is available in version 0.0.0-20260724112156-5bae0926b896.
Affected products
- SiYuan SiYuan before 0.0.0-20260724112156-5bae0926b896
Timeline
- 2026-09-04: disclosed: GitHub Advisory published
- 2026-07-24: patched: Patch commit 5bae0926b896 first made available