Executive brief
SiYuan is a personal knowledge management system with a publish mode that allows documents to be password-protected. The vulnerability allows anonymous users to read the full content of password-protected published documents by bypassing the password check on secondary content endpoints. An attacker can obtain internal document block IDs from publicly accessible search endpoints, then use those IDs to retrieve protected content through unprotected API endpoints, completely circumventing the password protection mechanism.
Technical details
This is an authentication bypass vulnerability (CWE-288) in SiYuan's publish mode affecting versions before v3.7.3. The root cause is inconsistent password enforcement: the primary getDoc endpoint correctly enforces publish-password checks via FilterContentByPublishAccess, but secondary content endpoints (getHeadingChildrenDOM, getHeadingDeleteTransaction, getHeadingLevelTransaction, getHeadingInsertTransaction, getBacklinkDoc, getBackmentionDoc) return rendered block DOM with no password verification. Combined with ID-leak endpoints like searchEmbedBlock that expose protected document block IDs while filtering content, an anonymous attacker on the unauthenticated publish mode port can chain these to retrieve full protected document content. The vulnerability requires only network access and no authentication; attack preconditions are met by design in published documents marked "protected" with a password. Impact is confidentiality-only (information disclosure); no data modification occurs. The fix involves applying the same publish-password/publish-access checks used in getDoc to all content-returning endpoints.
Affected products
- SiYuan SiYuan < 3.7.3
Timeline
- 2026-07-21: disclosed
- 2026-08-03: advisory: Published to GitHub Advisory Database
- 2026-07-21: patched: Fixed in v3.7.3