CVE-2026-87809

Deferred Deferred - Pending Action

Siyuan Embedded Block Content Exposure via Publish-Access Bypass

Publication date: 2026-09-09

Last updated on: 2026-09-18

Assigner: VulnCheck

Description

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-18

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87809

EUVD

EUVD-2026-74835

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-87809 is an information disclosure vulnerability in the Siyuan note-taking application affecting versions up to v3.8.1. It involves two endpoints, /api/export/preview and /api/lute/copyStdMarkdown, which fail to enforce publish-access filtering on embedded blocks. Attackers with reader access to public documents can retrieve the full content of private, hidden, or publish-disabled blocks embedded within those documents.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the affected endpoints /api/export/preview and /api/lute/copyStdMarkdown. Check if public documents contain embed queries referencing private or hidden blocks. Monitor for unauthorized access to sensitive data through these endpoints.

Impact Analysis

This vulnerability allows unauthorized users with read-only access to public documents to view sensitive information such as private notes, project data, client details, or credentials stored in embedded blocks. It does not require direct access to private documents or user interaction to exploit.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized disclosure of sensitive personal or health information stored in notes. Organizations using affected Siyuan versions may face legal and regulatory penalties due to potential data breaches.

Mitigation Strategies

Upgrade Siyuan to version 3.8.2 or later to address the vulnerability. Review and restrict access to public documents containing embed queries that reference private or hidden blocks. Monitor network traffic for unusual requests to /api/export/preview or /api/lute/copyStdMarkdown endpoints.

Hi! I’m here to help you understand CVE-2026-87809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70