CVE-2026-72805

Deferred Deferred - Pending Action

SiYuan Document Content Disclosure via API

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72805

EUVD

EUVD-2026-57465

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

SiYuan versions before v3.7.4 have a missing authorization check in three block endpoints: getBlockBreadcrumb, getRefText, and getBlockTreeInfos. This allows unauthorized users like anonymous readers or RoleReader accounts to access protected document content and metadata, including titles, ancestor block snippets, reference text, and path details from documents restricted by publish settings or passwords.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the endpoints getBlockBreadcrumb, getRefText, and getBlockTreeInfos. Check if these endpoints return sensitive document metadata or content without proper authorization. Review server logs for unusual access patterns or requests from anonymous users or RoleReader accounts to these endpoints.

Impact Analysis

Attackers can retrieve sensitive document details using block IDs, even from documents marked as publish-forbidden or password-protected. This includes document titles, content snippets, and metadata, leading to confidentiality breaches. The vulnerability is exploitable without privileges or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA, which mandate strict data protection and access controls. Unauthorized disclosure of protected content may result in legal and regulatory penalties.

Mitigation Strategies

Immediately update SiYuan to version v3.7.4 or later to apply the patch. If immediate updating is not possible, restrict access to the vulnerable endpoints by implementing publish-access checks manually. Ensure that the checkBlockPublishAccess function is applied to getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints to enforce proper authorization.

Hi! I’m here to help you understand CVE-2026-72805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70