Executive brief
SiYuan is a note-taking and knowledge management application. The application's publish feature allows controlled sharing of documents to readers with limited permissions. A flaw in the web server configuration allows attackers to bypass these access controls by accessing static file routes directly instead of through the REST API, potentially exposing sensitive templates, code snippets, and exported documents to unauthorized readers.
Technical details
This is a missing authorization (CWE-862) vulnerability affecting SiYuan's server mux configuration (kernel/server/serve.go). Several static file routes (/templates/, /snippets/, /widgets/, /plugins/, /emojis/, /export/) are registered with CheckAuth guard only, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST API applies to the same resources. The /templates/ route directly contradicts the REST API's refuseToAccess control, which explicitly blocks non-administrators from accessing templates. Attackers with a publish RoleReader token or anonymous access (when Publish.Auth.Enable is false) can bypass these restrictions by directly requesting static routes. The attack requires no authentication if auth is disabled, or only a low-privilege publish reader token. The fix requires applying the same access control logic used by /assets/* routes to the vulnerable static routes, or blocking them entirely for non-administrator roles. A patch is available in version 3.7.4.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-08-12: disclosed
- 2026: patched: Fixed in version 3.7.4