Executive brief
SiYuan is a note-taking and knowledge management application. This vulnerability allows an unauthenticated reader to retrieve the rendered content of documents that the administrator explicitly marked as hidden or forbidden from public access. An attacker can also determine whether a hidden document contains references to specific blocks, effectively creating a "reference oracle" that defeats access boundaries the administrator configured.
Technical details
This is a missing authorization vulnerability (CWE-862) in SiYuan's API endpoints for retrieving backlink and backmentioning content. The vulnerability stems from an asymmetry: list endpoints (getBacklink, getBacklink2) correctly apply publish-access filters via FilterPathsByPublishAccess to hide forbidden documents from readers, while content endpoints (getBacklinkDoc, getBackmentionDoc) lack this filter and only check generic authentication via CheckAuth. An attacker with network access can directly invoke the content endpoints with a known or guessed publish-forbidden document ID and block ID to retrieve the rendered HTML content of hidden documents. The attack requires knowledge of document and block IDs, but these can be obtained from other unfiltered CheckAuth-only endpoints. The impact is confidentiality-only (no modification possible), and no admin privileges, CSRF tokens, or write permissions are required. The fix involves applying the same publish-access check used by list endpoints to the content endpoints before returning rendered block DOM.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: v3.7.3 released as fix