Executive brief
SiYuan is a personal knowledge management application that allows users to publish their notes with access controls. Three API endpoints fail to enforce these access controls, permitting readers to access complete database schemas and enumerate block identifiers from documents they should not be able to see. An attacker can retrieve sensitive column definitions, user-authored descriptions, select option vocabularies (often containing category labels), and template logic from any database in the workspace, regardless of whether its host document is hidden or password-protected.
Technical details
The vulnerability encompasses three missing authorization checks in SiYuan's Go kernel API. First, getAttributeViewKeysByID (av.go, router line 548) returns a complete database column schema without applying the publish-access filter that its sibling endpoint getAttributeViewKeys applies—disclosing field names, descriptions, select vocabularies with color codes, Sprig template expressions, and relation targets. Second, getBlockDefIDsByRefText (router line 237) enumerates workspace-wide block IDs matching a caller-supplied anchor text, including blocks in private documents. Third, getBlockRelevantIDs (router line 274) traverses the block tree structure, yielding parent/previous/next block IDs and walking decrypted encrypted-notebook content when unlocked. All three are reachable via CheckAuth without CheckAdminRole, enabling access by publish RoleReader tokens and anonymous accounts when Publish.Auth.Enable is false. The root cause is the absence of FilterBlockAttributeViewKeysByPublishAccess and publish-scope checks in these handlers, while parallel functions apply them correctly. The fix involves gating these endpoints with the appropriate authorization filters, as demonstrated by their already-filtered siblings.
Affected products
- SiYuan SiYuan < 3.7.4
Timeline
- 2026-07-24: disclosed
- 2026-08-12: advisory
- 2026-08-15: patched: Fix released in v3.7.4