Executive brief
SiYuan is a popular note-taking and knowledge management application. A vulnerability in its /api/block/getBlockInfo endpoint allows anonymous readers or limited-privilege users to discover the titles and metadata of documents that administrators have explicitly marked as hidden from publication. While this does not expose the document contents themselves, it reveals the existence and location of sensitive notes that should remain completely hidden from readers, potentially aiding reconnaissance or embarrassing unintended disclosures.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the /api/block/getBlockInfo REST API endpoint. The endpoint accepts a caller-supplied block ID, validates only its format, and returns the containing document's root metadata (rootTitle, box, path, rootID, rootIcon) without verifying publish-access permissions. The sibling endpoint /api/block/getDocInfo correctly applies the IsReadOnlyRoleContext/publish-access filter before returning equivalent metadata, indicating the check was inadvertently omitted in getBlockInfo. Both endpoints are gated only by CheckAuth, making getBlockInfo reachable by the publish RoleReader token and anonymous accounts (when Publish.Auth.Enable is false). An attacker requires a valid block ID from the target document to exploit this; the endpoint does not enumerate arbitrary documents. Impact is confidentiality-only (metadata disclosure), with no access to document body content or ability to modify data.
Affected products
- siyuan-note siyuan < 3.7.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: v3.7.3 released with fix
- 2026-08-03: advisory: GHSA-pm3w-vxp9-ccwc published; GHSA-3rfw-7fxw-6jxm is duplicate
- 2026-09-03: other: GHSA-3rfw-7fxw-6jxm withdrawn as duplicate