SiYuan Block Attribute Exposure via Missing Access Control

Executive Summary

CVE-2026-72803 is an information disclosure vulnerability in SiYuan note-taking app versions before v3.7.4. The getBlockAttrs and batchGetBlockAttrs endpoints fail to enforce publish-access checks, allowing attackers to retrieve sensitive block attributes like names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /api/getBlockAttrs or /api/batchGetBlockAttrs endpoints with block IDs. Check SiYuan server logs for unauthorized access attempts to protected document attributes. Use tools like curl to test endpoints: curl -X POST http://<target>/api/getBlockAttrs -d '{"id":"block_id"}' and verify if sensitive data is returned.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access confidential metadata such as user-authored memos, document names, and custom fields from protected documents. This could lead to privacy breaches, intellectual property theft, or unauthorized access to sensitive information stored in SiYuan notes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personal or health-related data stored in protected documents. Unauthorized access to sensitive metadata may result in non-compliance with data protection requirements, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later. If upgrading is not possible, restrict access to the vulnerable endpoints via firewall rules or reverse proxy configurations. Disable anonymous access in publish mode and ensure all publish reader accounts have minimal privileges.

Useful 0 Not Useful 0