Description

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-12T20:17:52.247Z",
  "pubdate": "2026-08-12T20:17:52.247Z",
  "executiveSummary": "An authorization bypass vulnerability exists in SiYuan versions prior to v3.7.4, specifically within the getBlockAttrs and batchGetBlockAttrs endpoints.\nThe vulnerability stems from the application's failure to enforce proper publish-access validation when processing block attribute requests.\nUnauthenticated or unauthorized remote attackers can exploit this flaw by submitting specially crafted POST requests containing target block IDs to the affected API endpoints.\nSuccessful exploitation allows attackers to bypass security boundaries and retrieve sensitive block attributes, including internal names, aliases, memos, and custom fields associated with protected or private documents.\nThis unauthorized disclosure of metadata compromises document confidentiality and can expose sensitive organizational or personal information stored within the knowledge management system.\nThe risk implications are moderate to high depending on the sensitivity of the data managed within the SiYuan instance.\nRemediation requires upgrading the SiYuan deployment to version v3.7.4 or later, where access control enforcement is properly implemented for the vulnerable endpoints.",
  "technicalDetails": "The vulnerability resides within the backend API logic of SiYuan versions before v3.7.4, specifically handling the getBlockAttrs and batchGetBlockAttrs functions.\nThe root cause of the security issue is a missing access control check. The application fails to verify whether the requesting entity possesses legitimate publish-access permissions for the requested documents before returning data.\nThe affected components are the network endpoints responsible for retrieving block-level metadata via HTTP POST requests.\nAttackers exploit this flaw by interacting directly with the network service exposed by SiYuan. By sending a crafted POST request containing specific target block IDs to the vulnerable endpoints, the backend processes the request and returns the requested attribute data without validating user privileges.\nThe attack flow proceeds as follows: First, the attacker identifies or guesses valid block IDs within the SiYuan instance. Second, the attacker formulates an HTTP POST request targeting the getBlockAttrs or batchGetBlockAttrs endpoint, supplying the target block IDs in the payload. Third, the SiYuan server processes the request, bypassing any intended authorization logic for protected documents. Fourth, the server responds with the block attributes, revealing sensitive information such as names, aliases, memos, and custom fields.\nThe vulnerability can be leveraged remotely over the network without requiring prior authentication or specific user privileges, depending on the exposure of the SiYuan instance.\nThe post-exploitation impact includes the unauthorized extraction of metadata and structural information regarding private documents, potentially facilitating further attacks or exposing confidential notes and internal knowledge bases."
}