CVE-2026-72795 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in SiYuan before version 3.7.4 where the system fails to properly filter embedded block content based on publish access controls within the getBlockDOMWithEmbed and getBlockDOMsWithEmbed API endpoints. The flaw allows unauthorized access to sensitive information by exploiting the lack of proper access validation when processing embedded queries. When attackers make requests to these endpoints, they can retrieve published blocks that contain embedded references to password-protected, hidden, or forbidden documents, bypassing the intended security boundaries that should prevent such access.
The technical implementation of this vulnerability stems from insufficient input validation and access control enforcement within the block rendering logic. The system processes embedded content without verifying whether the requesting user has proper authorization to access the referenced documents, creating a path for information disclosure attacks. This type of vulnerability aligns with CWE-285, which addresses improper access control in software systems, and represents a privilege escalation issue where unauthorized users can access restricted content through manipulated API requests.
The operational impact of this vulnerability is significant as it allows attackers to extract sensitive data from documents that should be protected by access controls. An attacker could potentially gather confidential information from password-protected documents or hidden sections within the SiYuan knowledge management system, undermining the security posture of organizations relying on this platform for document management and collaboration. The vulnerability affects any user who can make requests to the affected endpoints regardless of their authentication status or authorization level.
Mitigation strategies should focus on implementing robust access control validation at the API endpoint level before processing embedded content queries. Organizations should upgrade to SiYuan version 3.7.4 or later where this vulnerability has been addressed through proper filtering mechanisms that validate user permissions against referenced documents before rendering embedded content. Additional protective measures include implementing rate limiting on these endpoints, logging all access attempts to embedded content, and conducting regular security reviews of API endpoint access controls to ensure proper authorization enforcement. This vulnerability demonstrates the critical importance of validating access controls at multiple layers of application logic as outlined in the ATT&CK framework's privilege escalation techniques where unauthorized data access can be achieved through API manipulation.