Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

SiYuan can leak block data to public readers

CVE-2026-74904 · published 2 months ago
Summary

Versions of SiYuan prior to 3.7.4 let anyone viewing a published notebook see internal block information. The software fails to check whether a user is authorized before returning metadata and text for any block, so private content and workspace structure can be revealed. Update to version 3.7.4 or later, or restrict publishing access, to stop the leakage.

What to do
  • Update github.com siyuan-note to version 0.0.0-20260804015139-bd067a4fe9b2.
  • Update siyuan-note github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260804015139-bd067a4fe9b2.
  • Update siyuan-note siyuan to version 3.7.4 or later.
Affected software
Ecosystem VendorProductAffected versions
– siyuan-note siyuan < 3.7.4
go github.com siyuan-note < 0.0.0-20260804015139-bd067a4fe9b2
Fix: upgrade to 0.0.0-20260804015139-bd067a4fe9b2
Go siyuan-note github.com/siyuan-note/siyuan/kernel < 0.0.0-20260804015139-bd067a4fe9b2
Fix: upgrade to 0.0.0-20260804015139-bd067a4fe9b2
Original advisory text
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-204Observable Response Discrepancy
Timeline
Published18 Aug 2026
Updated4 Nov 2026
First seen18 Aug 2026
Sources
CVE-2026-74904 · NVD
CVE-2026-74904 · MITRE
GHSA-4vpg-gwqq-w44c · GHSA
GO-2026-6654 · OSV
Track software like this
Free during beta