CVE-2026-72805: Missing Authorization in SiYuan Note Block APIs Leads to Information Disclosure
Vulnerability ID: CVE-2026-72805
CVSS Score: 6.9
Published: 2026-09-03
SiYuan Note versions before v3.7.4 fail to enforce publish-access checks on several block API endpoints. This vulnerability allows anonymous readers or authorized accounts with low-privileged roles to retrieve sensitive document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying target block IDs.
TL;DR
Missing publish-access checks in SiYuan Note block APIs allow unauthorized access to protected document content and layout metadata via direct API requests.
Technical Details
- Vulnerability ID: CVE-2026-72805
- Weakness Class: CWE-862 (Missing Authorization)
- CVSS v4.0 Score: 6.9 (Medium)
- Attack Vector: Network (AV:N)
- Exploit Status: None (No public PoC or weaponized exploit)
- KEV Status: Not listed
Affected Systems
- SiYuan Note
-
siyuan: >= 0, < 3.7.4 (Fixed in:
3.7.4)
Code Analysis
Commit: 931ba69
🔒 Enforce publish access for block metadata
Mitigation Strategies
- Upgrade SiYuan Note to version v3.7.4 or higher to enforce publish-access validation globally.
- Deactivate Publish Mode entirely if notebooks are purely private.
- Deploy reverse proxies (e.g., Nginx, Caddy) with HTTP authentication or IP address filtering.
Remediation Steps:
- Identify all running self-hosted SiYuan Note instances.
- Check current application version via the user interface or container manifest.
- Pull the official v3.7.4 (or later) image or binary release.
- Apply the update and verify that restricted blocks are no longer accessible without proper authentication context.
References
Read the full report for CVE-2026-72805 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)