Executive brief
SiYuan is a note-taking and knowledge management application. Three API endpoints (getBlockBreadcrumb, getRefText, getBlockTreeInfos) fail to enforce access controls on protected documents, allowing unauthorized users to read document titles, content snippets, and metadata from documents explicitly marked private or password-protected. An attacker with knowledge of block IDs can retrieve sensitive document content without proper authorization.
Technical details
This is a missing authorization (CWE-862) vulnerability in three sibling API endpoints within SiYuan's block API. The vulnerability exists because getBlockBreadcrumb, getRefText, and getBlockTreeInfos lack the checkBlockPublishAccess authorization check that their sibling endpoint getBlockInfo correctly implements. An attacker in the publish-reader role or anonymous user (when auth is disabled) can call these three endpoints with arbitrary block IDs to retrieve document content and metadata. The endpoints return: (1) full ancestor chain with content snippets via getBlockBreadcrumb; (2) block reference/anchor text (document content) via getRefText; (3) root ID, title, and path metadata via getBlockTreeInfos. The attack is network-reachable, requires no privileges, and affects publish-mode deployments. The fix is to add checkBlockPublishAccess authorization gates to all three endpoints, consistent with getBlockInfo. Patched in v3.7.4.
Affected products
- SiYuan SiYuan < 3.7.4
Timeline
- 2026-08-12: disclosed
- 2026-07-23: patched: patched version v3.7.4