Executive brief
SiYuan is a note-taking and knowledge management application that supports password-protected document sharing. The graph API endpoints used to visualize document relationships and structure failed to enforce password checks, allowing unauthenticated users to read the complete text content of password-protected documents along with all their cross-references. This exposure defeats the password protection mechanism for sensitive shared content.
Technical details
The vulnerability is an authorization bypass (CWE-862, CWE-200) in the getGraph and getLocalGraph endpoints. These endpoints filter nodes based only on the visibility tier but never validate the publish-password tier. Password-protected documents are marked as Visible=true, so their graph nodes survive the visibility filter unchanged. Graph node titles expose the actual block content text, not just document titles. The endpoints are reachable by unauthenticated publish readers and anonymous users when auth is disabled. An attacker can call these endpoints without authentication to retrieve per-block content and the full reference/backlink topology of all password-protected documents in the workspace. The fix requires extending FilterGraphByPublishIgnore to evaluate the password tier and drop nodes unless the password is unset or a valid auth cookie is presented.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-24: disclosed
- 2026: patched: v3.7.4 patches the vulnerability