DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72803: CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API

#security #cve #cybersecurity

CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API

Vulnerability ID: CVE-2026-72803
CVSS Score: 6.9
Published: 2026-09-03

An information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.

TL;DR

Unauthenticated remote attackers can bypass document-level protection rules (such as passwords or disabled-publish states) to read sensitive block metadata by directly querying the getBlockAttrs and batchGetBlockAttrs endpoints with known block IDs.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9 (Medium)
  • EPSS Score: 0.00237 (0.237%)
  • Impact: Partial Confidentiality Loss
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Personal Knowledge Management System
  • siyuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 229fdff

Enforce publish-access check on getBlockAttrs and batchGetBlockAttrs

Exploit Details

  • VulnCheck: Exploit description detailing the missing authorization validation and query vectors.

Mitigation Strategies

  • Upgrade SiYuan to version v3.7.4 or later.
  • Restrict access to vulnerable API endpoints via reverse proxy rules.
  • Avoid storing highly sensitive credentials or text within block attributes.

Remediation Steps:

  1. Verify the current version of the SiYuan container or executable.
  2. Pull the latest Docker image of SiYuan (v3.7.4+) or update the application binaries.
  3. Restart the service to apply the patch.
  4. If upgrading is delayed, configure Nginx or Caddy reverse proxies to return HTTP 403 for POST requests to /api/attr/getBlockAttrs and /api/attr/batchGetBlockAttrs from untrusted IP spaces.

References

Read the full report for CVE-2026-72803 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)