CVE-2026-74904
Received Received - Intake

SiYuan Block Metadata Exposure via Missing Authorization Checks

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74904
EUVD
EUVD-2026-60585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.4 has missing authorization checks in 17 block metadata and content endpoints. These endpoints only use basic authentication and lack publish-access filtering, allowing anonymous users in publish mode to access private block content, structural metadata, and existence information for any block ID in the workspace.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before 3.7.4. Inspect the kernel/api/block.go file for the 17 affected endpoints (e.g., getRefText, checkBlockExist, getBlockBreadcrumb) and verify if they lack publish-access filtering. Test these endpoints by sending unauthenticated requests to see if they return sensitive block metadata or content.

Impact Analysis

An attacker could exploit this to disclose private block content, metadata, or existence information by sending crafted API requests. This could reveal unpublished or restricted data in your SiYuan workspace without needing authentication or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing private user content or metadata without proper access controls.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later. If upgrading is not possible, restrict network access to the SiYuan instance, disable publish mode, or apply temporary access controls to the affected endpoints. Monitor logs for suspicious API requests targeting these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart