CVE-2026-68585: CVE-2026-68585: Metadata Disclosure via Missing Authorization in SiYuan API

#security #cve #cybersecurity

CVE-2026-68585: Metadata Disclosure via Missing Authorization in SiYuan API

Vulnerability ID: CVE-2026-68585
CVSS Score: 5.8
Published: 2026-09-03

A metadata disclosure vulnerability exists in SiYuan prior to version v3.7.3. The /api/block/getBlockInfo endpoint fails to validate authorization boundaries in publish mode, allowing anonymous readers to access private document metadata.

TL;DR

Unauthenticated remote attackers can bypass authorization controls to exfiltrate private document metadata in SiYuan knowledge management servers by sending crafted API requests to /api/block/getBlockInfo.

Technical Details

CWE ID: CWE-862
Attack Vector: Network
CVSS v3.1 Score: 5.8
EPSS Score: 0.00194 (Percentile: 9.16%)
Impact: Information Disclosure (Metadata Leakage)
Exploit Status: None / No Public PoC
KEV Status: Not Listed

Affected Systems

SiYuan Personal Knowledge Management System
SiYuan: < v3.7.3 (Fixed in: v3.7.3)

Code Analysis

Commit: ffde3b2

Fix metadata disclosure by implementing checkBlockInfoPublishAccess across getBlockInfo, getDocInfo, and getDocsInfo API handlers.

Mitigation Strategies

Upgrade to SiYuan v3.7.3 or later
Disable public publish mode to prevent unauthenticated access
Implement reverse proxy rules to block /api/block/getBlockInfo for external users

Remediation Steps:

Identify running SiYuan instances and verify their versions.
Download and apply the upgrade package for version v3.7.3 or higher.
If immediate upgrade is not possible, disable public publishing inside settings.
Verify endpoint restriction by attempting anonymous API requests to the patched endpoints.

References

Read the full report for CVE-2026-68585 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community