CVE-2026-72803 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified in SiYuan versions prior to v3.7.4 represents a critical authorization bypass flaw that undermines the application's access control mechanisms. This issue affects the getBlockAttrs and batchGetBlockAttrs endpoints where the system fails to properly validate user permissions before returning block attribute data. The flaw allows unauthenticated or unauthorized users to extract sensitive information including block names, aliases, memos, and custom fields from documents that should be protected. According to CWE-285, this constitutes an improper authorization vulnerability where the application does not adequately verify that the requesting entity has sufficient privileges to access the requested resources.
The technical implementation of this vulnerability stems from insufficient input validation and access control enforcement within the API endpoints. When attackers send POST requests containing specific block IDs to these endpoints, the system processes the requests without performing proper authentication checks or authorization verification. This behavior violates fundamental security principles outlined in the OWASP Top Ten 2021, specifically addressing insufficient logging and monitoring as well as broken access control. The vulnerability exists because the application assumes that legitimate requests originate from authorized users without implementing proper session validation or permission checking mechanisms.
Operationally, this flaw enables attackers to systematically harvest sensitive data from protected documents, potentially exposing confidential information stored within SiYuan's knowledge management system. The impact extends beyond simple data leakage as attackers can gather structured information about document contents, user activities, and organizational knowledge bases. This vulnerability aligns with ATT&CK technique T1213.002 for Data from Information Repositories, where adversaries collect information from repositories and databases. The ability to extract block attributes in bulk through the batchGetBlockAttrs endpoint amplifies the potential damage by allowing attackers to systematically enumerate and harvest large volumes of data without detection.
Organizations using SiYuan versions before v3.7.4 face significant security risks including unauthorized access to proprietary content, intellectual property theft, and potential compliance violations. The vulnerability can be exploited through automated tools that rapidly send requests to the affected endpoints, making it difficult for administrators to detect malicious activity. Mitigation strategies should include immediate upgrade to SiYuan version 3.7.4 or later where proper access controls have been implemented. Additionally, network segmentation, API rate limiting, and enhanced monitoring of these specific endpoints can provide additional defense layers. Security teams should also implement proper logging and alerting mechanisms to detect unusual patterns of requests to the getBlockAttrs and batchGetBlockAttrs endpoints, as recommended in NIST SP 800-53 control AC-3. The vulnerability demonstrates the critical importance of implementing principle of least privilege and proper access control validation at all API entry points.