Executive brief
SiYuan is a note-taking and knowledge management application that supports publish mode for sharing documents with readers. Three API endpoints for manipulating headings lack proper access checks and expose full rendered content of publish-disabled documents to anonymous readers. An attacker who knows a heading ID can retrieve complete document contents that administrators explicitly restricted, bypassing all publish access controls.
Technical details
The vulnerability is a missing authorization check (CWE-862) in three API endpoints: /api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction. These endpoints are gated only by CheckAuth, which permits access from the publish RoleReader token and anonymous users when auth is disabled. Despite their write-implying names, these endpoints only compute and return a transaction object containing rendered HTML of the heading subtree, performing no mutations. The rendered DOM is returned without invoking the same publish-access filter (IsReadOnlyRoleContext) that the reader-safe content path (getDoc) applies to gate sensitive content. An unauthenticated attacker in publish mode can supply a heading block ID to retrieve full content of publish-disabled documents. The attack requires knowledge of the target heading's block ID, which is obtainable from other CheckAuth-only endpoints lacking publish filters. The vulnerability affects versions up to and including v3.7.2; patched in v3.7.3 by applying the same publish-access filter used by getDoc.
Affected products
- SiYuan Note SiYuan <= 3.7.2
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: v3.7.3 released
- 2026-08-03: advisory