4268 matches found
SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...
EUVD-2026-57458
SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns...
SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking
CVE: This vulnerability corresponds to CVE-2026-72801. Summary Two CheckAuth-only endpoints disclose the complete offline attack material for the encrypted-notebook master password, plus the wrapped per-notebook key needed to use it. Both are reachable by the publish RoleReader token and by the...
GHSA-VPJW-WF5H-CGPQ SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...
SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
CVE: This vulnerability corresponds to CVE-2026-72805. Summary Three block endpoints return document content snippets and metadata without any publish-access check, while their sibling getBlockInfo which returns comparable data does enforce one. All three are CheckAuth-only, so they are reachable...
EUVD-2026-57465
SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents...
EUVD-2026-58625
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...
GHSA-MW8R-MW84-88V2 SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72810. Summary WebSocket sessions established through the publish surface port 6808, RoleReader anonymous when Publish.Auth.Enable is false are added to the same broadcast session pool as authenticated sessions. The kernel's broadcast functions push...
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72810. Summary WebSocket sessions established through the publish surface port 6808, RoleReader anonymous when Publish.Auth.Enable is false are added to the same broadcast session pool as authenticated sessions. The kernel's broadcast functions push...
EUVD-2026-58626
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle...
EUVD-2026-58627
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode...
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...
EUVD-2026-52273
SiYuan: Cross-boundary metadata disclosure via getBlockInfo publish mode: reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered...
EUVD-2026-52275
SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...
EUVD-2026-52279
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...
EUVD-2026-52277
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...
CVE-2026-82652 SiYuan before v3.8.1 Information Disclosure via Publish Access
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...
CVE-2026-82652 SiYuan before v3.8.1 Information Disclosure via Publish Access
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...