Is CVE-2026-74904 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74904 being exploited in the wild.

How severe is CVE-2026-74904?

High severity, with a CVSS score of 7.5, published 2 October 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260804015139-bd067a4fe9b2, SEMVER:introduced=0,fixed=0.0.0-20260804015139-bd067a4fe9b2; SiYuan prior to fix (current HEAD eef1056/1673b75 as of 2026-08-03).

How is CVE-2026-74904 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-74904?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74904: SiYuan block metadata endpoints missing authorization

Q: Is there a fix for CVE-2026-74904?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260804015139-bd067a4fe9b2 or later. Until then: Add IsReadOnlyRoleContext authorization guards to all 17 affected endpoints in kernel/api/block.go, matching the pattern correctly implemented by getBlockInfo, getBlockDOM, and getRefIDs in the same file. Audit all /api/* handlers systematically for presence of access-check references to catch similar gaps across other files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-74904 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-74904?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74904 · Severity: high · CVSS 7.5 · Published 2026-10-02

SiYuan is a note-taking application that supports publishing workspaces for sharing. Seventeen block metadata and content endpoints lack access controls, allowing anonymous visitors to read reference text, structural metadata, and existence information for any block in the entire workspace, including unpublished private content. An attacker can retrieve actual block content, confirm block existence, and enumerate private notebooks without any authentication.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-74904 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74904 being exploited in the wild.
How severe is CVE-2026-74904?: High severity, with a CVSS score of 7.5, published 2 October 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260804015139-bd067a4fe9b2, SEMVER:introduced=0,fixed=0.0.0-20260804015139-bd067a4fe9b2; SiYuan prior to fix (current HEAD eef1056/1673b75 as of 2026-08-03).
Is there a fix for CVE-2026-74904?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260804015139-bd067a4fe9b2 or later. Until then: Add IsReadOnlyRoleContext authorization guards to all 17 affected endpoints in kernel/api/block.go, matching the pattern correctly implemented by getBlockInfo, getBlockDOM, and getRefIDs in the same file. Audit all /api/* handlers systematically for presence of access-check references to catch similar gaps across other files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74904 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-74904?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260804015139-bd067a4fe9b2 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260804015139-bd067a4fe9b2
```

Add IsReadOnlyRoleContext authorization guards to all 17 affected endpoints in kernel/api/block.go, matching the pattern correctly implemented by getBlockInfo, getBlockDOM, and getRefIDs in the same file. Audit all /api/* handlers systematically for presence of access-check references to catch similar gaps across other files.

Technical details

CWE-862 (Missing Authorization): 17 handlers in kernel/api/block.go are gated only by model.CheckAuth with no admin-role requirement and lack any of the access-check functions (IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess) used correctly by sibling endpoints in the same file. Network-reachable endpoints like getRefText and checkBlockExist return real content-derived text and structural metadata for any supplied block ID with no authorization checks. Sibling functions in the same file confirm this is an oversight rather than intentional design, as they correctly implement the required access guards.

Affected products

SiYuan SiYuan prior to fix (current HEAD eef1056/1673b75 as of 2026-08-03)

Identifiers

CVE-2026-74904
GHSA-4vpg-gwqq-w44c
GO-2026-6654

Timeline

2026-10-02: disclosed
2026-08-03: other: Vulnerability present at HEAD commit eef1056/1673b75

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.