Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs...

Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6mcf-g667-w3qv. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter...

GHSA-89HF-XCX5-R9R6 Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-67x2-mq63-v9vm. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and...

GHSA-CJWM-9H7G-PCR9 Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h6w7-xxcf-w2mq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and...

Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fgmr-7w36-9qfq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypas...

Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8x84-r2ff-h8pq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through...

GHSA-FXMW-RV85-5HWH Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...

Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...

GHSA-V3V5-7J3J-CC6F Duplicate Advisory: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5w7r-f4cg-rqq7. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution...

GHSA-XX34-6CJG-PRH8 Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v684-q882-jgmq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly...

Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v684-q882-jgmq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly...

Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h6w7-xxcf-w2mq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and...

GHSA-CM9F-W4H4-7J85 Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fgmr-7w36-9qfq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypas...

GHSA-HR3F-QFRH-H7W5 Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8x84-r2ff-h8pq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through...

GHSA-HG4J-W33M-P7G4 Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34fj-mwm6-fjfg. This link is maintained to preserve external references. Original Description siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to...

CVE-2026-72808

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

CVE-2026-72797

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72796

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...

CVE-2026-72800

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...