GO-2026-6387 SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents in github.com/siyuan-note/siyuan/kernel

🗓️ 10 Sep 2026 14:48:42Reported by GoogleType

osv🔗 osv.dev👁 7 Views

Missing access check in SiYuan kernel discloses content and metadata of protected documents.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-72805	12 Aug 202619:07	–	attackerkb
Circl	CVE-2026-72805	4 Sep 202600:35	–	circl
CVE	CVE-2026-72805	12 Aug 202619:07	–	cve
Cvelist	CVE-2026-72805 SiYuan before v3.7.4 Information Disclosure via Block Endpoints	12 Aug 202619:07	–	cvelist
EUVD	EUVD-2026-57465	3 Sep 202622:52	–	euvd
Github Security Blog	SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents	3 Sep 202622:52	–	github
Github Security Blog	Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents	12 Aug 202621:31	–	github
NVD	CVE-2026-72805	12 Aug 202620:17	–	nvd
OSV	GHSA-67X2-MQ63-V9VM SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents	3 Sep 202622:52	–	osv
Positive Technologies	PT-2026-71247	12 Aug 202600:00	–	ptsecurity

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72805
github	www.github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f
vulncheck	www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpoints

10 Sep 2026 15:15Current

CVSS 3.15.8

CVSS 46.9

EPSS0.00237

SiYuan kernel Missing access check content disclosure getBlockBreadcrumb getRefText getBlockTreeInfos