CVE-2026-72803
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
Risk Assessment
The risk is unauthorized disclosure of block attributes from protected documents, potentially leading to leakage of sensitive information.
Recommendation
Upgrade SiYuan to version 3.7.4 or later to fix the missing access controls.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.