CVE-2026-72805 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in SiYuan versions prior to v3.7.4 represents a critical access control flaw that undermines the security model of the document management system. This issue affects three specific API endpoints including getBlockBreadcrumb, getRefText, and getBlockTreeInfos which are designed to provide contextual information about document structures and references. The flaw stems from inadequate authorization checks that fail to verify whether the requesting user possesses sufficient privileges to access the requested content, effectively bypassing the publish access controls that should protect sensitive documents.
The technical implementation of this vulnerability allows unauthorized users to exploit the system through direct API calls using block identifiers as parameters. When an anonymous user or a RoleReader account with publish permissions attempts to access these endpoints, the system responds with document titles, ancestor block content snippets, reference text, and path metadata without proper authentication verification. This information disclosure occurs regardless of whether the target documents are marked as publish-forbidden or protected by password restrictions, creating a significant data exposure risk.
The operational impact of this vulnerability extends beyond simple information leakage to encompass potential document compromise and unauthorized content access. Attackers can systematically gather structural information about protected documents, enabling them to understand document hierarchies, identify sensitive content through reference text extraction, and potentially reconstruct document relationships even when direct content access is blocked. This metadata exposure creates a comprehensive view of the document repository structure that could facilitate more sophisticated attacks targeting specific documents or content types.
The vulnerability aligns with CWE-284 Access Control Issues, specifically addressing insufficient access control enforcement mechanisms within API endpoints. From an attack framework perspective, this weakness maps to multiple ATT&CK techniques including T1078 Valid Accounts for maintaining persistent access and T1566 Phishing for Initial Access, as attackers could leverage the information gathered to craft more targeted attacks. The flaw also relates to T1213 Data from Information Repositories, where adversaries systematically collect data from document management systems.
Mitigation strategies should focus on implementing robust authorization checks at all API endpoints that handle document-related metadata. System administrators must update to SiYuan version 3.7.4 or later where the access control enforcement has been properly implemented. Additional protective measures include monitoring API access logs for unusual patterns of block ID requests, implementing rate limiting on metadata retrieval endpoints, and ensuring proper role-based access controls are enforced throughout the system. The fix should incorporate comprehensive permission verification before returning any document structure or metadata information, ensuring that only authorized users can access protected content through these endpoints.