Executive brief
SiYuan is a note-taking and knowledge management application that supports embedding content from other documents via embed queries. The getBlockDOMWithEmbed and getBlockDOMsWithEmbed API endpoints fail to check publish access permissions on embedded blocks, allowing anonymous readers or publish-mode users to view the full content of password-protected, hidden, or forbidden documents by requesting any published document that contains an embed query referencing that content. This exposes sensitive private information to unauthorized readers through normal published document viewing.
Technical details
This is a missing authorization vulnerability (CWE-862) in the /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed endpoints. These endpoints apply publish access checks only to the top-level requested block ID but fail to filter embedded blocks resolved via embed (transclusion) queries. The vulnerable code path is getBlockDOMWithEmbed → GetBlockDOMsWithEmbedInBox → resolveEmbedContentInBox, which executes embed queries and inlines their matched block content via SetIALAttr("embed-content") without any publish access filtering. In contrast, the sibling getEmbedBlock endpoint correctly applies FilterEmbedBlocksByPublishAccess for reader roles. An attacker can exploit this by requesting any legitimately-published block containing an embed query; the response will include HTML content of every block matched by that query, including blocks in non-published, hidden, forbidden, or password-protected documents. No authentication is required when publish mode is enabled (default port 6808). The fix requires threading the publishAccess context into resolveEmbedContentInBox and applying the same access checks applied by FilterEmbedBlocksByPublishAccess. The vulnerability was patched in v3.7.4.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-25: disclosed: Original advisory GHSA-h6w7-xxcf-w2mq published
- 2026-08-12: advisory: GHSA-cjwm-9h7g-pcr9 published as duplicate
- 2026-09-04: other: GHSA-cjwm-9h7g-pcr9 withdrawn as duplicate of GHSA-h6w7-xxcf-w2mq
- 2026-07-25: patched: Fixed in v3.7.4