Executive brief
Siyuan is a note-taking and knowledge management application. The search API endpoint filters private content from results but still returns match counts for hidden documents, allowing unauthenticated readers to discover whether private notes contain specific keywords and how many matches exist. This leaks information about the existence and volume of unpublished content.
Technical details
The vulnerability is an information disclosure issue in the POST /api/search/fullTextSearchBlock endpoint. The root cause is that the handler filters private blocks from the results array but returns unfiltered match counts (matchedBlockCount, matchedRootCount, pageCount) calculated before filtering. An unauthenticated user in publish mode can submit arbitrary search queries and observe positive match counts for content in hidden or unpublished documents while receiving an empty blocks array. The vulnerability affects Siyuan versions before v3.8.2 and was patched in v3.8.2. No authentication is required, and the attack is triggered by a simple HTTP POST request from a network-reachable endpoint.
Affected products
- Siyuan Siyuan before 3.8.2
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Patched in v3.8.2