CVE-2026-68585 in siyuan
Summary
by MITRE • 08/03/2026
SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as excluded from publishing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists in SiYuan versions prior to v3.7.3 within the /api/block/getBlockInfo endpoint which exposes sensitive metadata information without proper authorization checks. The flaw allows unauthorized access to document metadata including title, notebook name, file path, root ID, and icon for documents that have been explicitly marked as excluded from publishing by administrators. This represents a significant information disclosure issue where the system fails to enforce publish access controls when retrieving block information, creating a bypass mechanism for users who should not have visibility into restricted content.
The technical implementation of this vulnerability stems from insufficient input validation and access control enforcement within the block metadata retrieval functionality. When an authenticated user or anonymous reader supplies a valid block ID through the API endpoint, the system returns comprehensive document metadata regardless of the document's publishing restrictions. This behavior violates fundamental security principles of least privilege and access control enforcement, as the system should verify whether the requesting entity has appropriate permissions before disclosing such information.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks. Adversaries could use this flaw to enumerate documents within a SiYuan instance, understand document hierarchies, identify sensitive content locations, and map out organizational knowledge structures. The exposure of notebook names, file paths, and document titles provides attackers with valuable reconnaissance data that could facilitate targeted attacks against specific documents or content areas. This vulnerability particularly affects organizations relying on SiYuan for collaborative workspaces where access control is critical for maintaining information security.
Security controls should implement proper authorization checks before returning block metadata, ensuring that only users with appropriate publish permissions can access information about restricted documents. The fix requires enforcing access control validation at the API endpoint level, validating user roles and permissions against document publishing restrictions before returning any metadata. Organizations should also consider implementing additional monitoring for unusual API access patterns targeting block information endpoints and ensure proper role-based access controls are configured to prevent unauthorized access to sensitive metadata.
This vulnerability aligns with CWE-200 (Information Exposure) and CWE-732 (Incorrect Permission Assignment) categories, representing a clear failure in access control enforcement. From an ATT&CK perspective, this issue maps to T1566 (Phishing) and T1083 (File and Directory Discovery) as attackers could leverage the disclosed metadata for social engineering campaigns or to identify valuable targets within the system. The vulnerability demonstrates how insufficient input validation combined with inadequate access control checks creates a pathway for unauthorized information disclosure that can significantly impact organizational security posture.
Organizations should immediately implement the available patch for SiYuan v3.7.3 or higher while reviewing existing access controls and monitoring configurations. Security teams should also conduct comprehensive audits of all API endpoints to identify similar authorization gaps and ensure proper implementation of principle of least privilege across all system components. Regular security assessments including penetration testing of application programming interfaces should be conducted to prevent similar vulnerabilities from being introduced through development practices that do not adequately address access control requirements.