GitHub Security Advisory (GHSA-67x2-mq63-v9vm)Vendor advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vm CVE-2026-72805
MEDIUM
SiYuan before v3.7.4 Information Disclosure via Block Endpoints
Record summary
CVE-2026-72805 has a selected CVSS score of 6.9 (medium).
Description
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | Before 3.7.4 | affected |
| 3.7.4 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-72805 VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Block EndpointsThird-party advisory
https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpoints