Executive brief
SiYuan is a note-taking and document management application. Two API endpoints (`getBlockAttrs` and `batchGetBlockAttrs`) fail to enforce access controls on document blocks marked as publish-forbidden or password-protected. An attacker can read sensitive block metadata including user-written memos and custom fields from protected documents without authorization, with the batch endpoint enabling bulk extraction of attributes across an entire workspace.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two Go API handlers. The `getBlockAttrs` and `batchGetBlockAttrs` handlers directly query the database (`sql.GetBlockAttrs`, `sql.BatchGetBlockAttrs`) without calling the sibling guard function `checkBlockPublishAccess` that protects the analogous `getBlockInfo` endpoint. Both handlers are registered with `CheckAuth` only, making them accessible to anonymous users when `Publish.Auth.Enable` is false and to any `RoleReader` publish token. Exploitation requires network access to the publish port (default 6808) and knowledge of valid block IDs; no user interaction is needed. The attacker can extract the block's entire internal attribute list (IAL)—including name, alias, memo (user-authored notes), bookmark, tags, and arbitrary custom fields—from any block, including those in protected documents. The batch variant accepts an ID list in a single request, enabling workspace-wide attribute sweep attacks. The suggested fix is to apply `checkBlockPublishAccess` per-ID before returning results.
Affected products
- siyuan-note siyuan < 0.0.0-20260724093256-229fdffd7e4a
Timeline
- 2026-07-24: disclosed: GitHub Security Advisory published
- 2026-09-03: advisory: Published to GitHub Advisory Database and CVE-2026-72803 assigned
- 2026-07-24: patched: Patch available in commit 229fdffd7e4afdef543d4d8495657fda8a369400