Executive brief
SiYuan is a note-taking and knowledge management application that supports publishing documents to the web. Two API endpoints (getBlockAttrs and batchGetBlockAttrs) fail to check access permissions, allowing unauthenticated or unprivileged users to retrieve sensitive metadata (names, aliases, memos, custom fields) from documents marked as protected or password-restricted. An attacker can extract attributes in bulk from entire workspaces by supplying block IDs.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two API endpoints: POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs. Both endpoints directly return the full internal attribute list (IAL) for blocks without calling checkBlockPublishAccess, unlike the related getBlockInfo endpoint which does perform this check. The endpoints are registered with CheckAuth only, making them accessible to the publish RoleReader token and anonymous users when authentication is disabled. An attacker can request block attributes by ID and receive the block's name, alias, memo, bookmark, tags, and custom attributes; the batch variant allows bulk extraction across an entire workspace in a single request. The attack is network-reachable with no authentication or user interaction required. SiYuan v3.7.4 and later patch this by applying the publish-access filter before returning attributes.
Affected products
- SiYuan SiYuan <=v3.7.2
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in v3.7.4; original advisory (GHSA-qvq9-hq6p-v378) published same day; this duplicate withdrawn 2026-09-03