CVE-2026-73606 in SiYuan
Summary
by MITRE • 08/13/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within SiYuan knowledge management software where version v3.7.4 and earlier contain a critical information disclosure flaw in the /api/block/getRefIDs endpoint. This endpoint is designed to retrieve references between blocks within documents but fails to properly validate access permissions for password-protected content. The flaw represents a direct violation of access control principles as defined by CWE-284 Access Control and CWE-359 Privacy Violation, allowing unauthorized parties to bypass authentication mechanisms that should protect sensitive document contents.
The technical implementation of this vulnerability stems from insufficient input validation and authorization checks within the API endpoint. When a request is made to /api/block/getRefIDs, the system does not verify whether the requesting party has proper authorization to access the referenced documents, particularly those protected by passwords. This creates an information leakage scenario where any unauthenticated user can query the endpoint and receive block identifiers from password-protected documents without providing the necessary credentials. The vulnerability operates at the application layer and demonstrates poor privilege management practices that align with ATT&CK technique T1213 Data from Information Repositories.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to map document structures and identify relationships between content blocks within protected documents. This metadata exposure can facilitate more sophisticated attacks where adversaries use the discovered block identifiers to craft targeted exploitation attempts against specific document sections. The vulnerability particularly affects environments where sensitive information is stored in password-protected documents, as the structural information can reveal organizational patterns and potentially aid in social engineering campaigns or further privilege escalation attempts.
Organizations using SiYuan versions prior to v3.7.4 should immediately implement mitigations including updating to the patched version that addresses this access control flaw. Additional defensive measures include network-level restrictions on accessing the vulnerable API endpoint, implementing additional authentication layers for critical document access, and conducting thorough audits of document permissions and access logs. The vulnerability highlights the importance of proper input validation and authorization checking in web applications, with implications for compliance with data protection regulations and security frameworks that require robust access control mechanisms to prevent unauthorized information disclosure.