Executive brief
SiYuan is a note-taking and knowledge management application. Three API endpoints that retrieve document content and metadata (getBlockBreadcrumb, getRefText, getBlockTreeInfos) lack access control checks that should prevent readers from accessing documents marked as publish-forbidden or password-protected. An attacker can retrieve document titles, content snippets, and metadata by knowing a block ID, bypassing intended publish restrictions.
Technical details
The vulnerability is a missing authorization check (CWE-862) in three API handlers within kernel/api/block.go: getBlockBreadcrumb, getRefText, and getBlockTreeInfos. The sibling endpoint getBlockInfo correctly calls checkBlockPublishAccess() to verify publish permissions before returning data, but these three handlers do not. Attackers with network access to the publish API (default port 6808) can send POST requests with arbitrary block IDs to retrieve: (1) full ancestor chain with document titles and content snippets via getBlockBreadcrumb, (2) block reference/anchor text (document content) via getRefText, and (3) root ID, title, and path metadata via getBlockTreeInfos. The precondition is knowing a block ID, which can be obtained from other reader-accessible endpoints. Additionally, the handlers accept a notebook parameter routing to *InBox variants, allowing the same disclosure for encrypted notebooks while unlocked. A patch was released in commit 931ba69 adding the required access checks.
Affected products
- SiYuan SiYuan < 0.0.0-20260723163028-931ba693375e
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Patch released commit 931ba693375ea9877b2ef74f9bfb632fad5bab3f