Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs...

Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...

GHSA-FXMW-RV85-5HWH Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...

GHSA-CJWM-9H7G-PCR9 Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h6w7-xxcf-w2mq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and...

CVE-2026-72795

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

CVE-2026-72805

Affected software: SiYuan before v3.7.4. Root cause: endpoints getBlockBreadcrumb, getRefText, and getBlockTreeInfos do not enforce publish-access checks. Impact: anonymous readers or publish RoleReader accounts can disclose document titles, ancestor block content snippets, reference text, and pa...

CVE-2026-72805 SiYuan before v3.7.4 Information Disclosure via Block Endpoints

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

CVE-2026-72803

SiYuan before v3.7.4 fails to enforce publish-access checks in getBlockAttrs and batchGetBlockAttrs. An attacker can retrieve block attributes (names, aliases, memos, custom fields) from protected documents by sending POST requests with block IDs. Affected: SiYuan

CVE-2026-72800 SiYuan before v3.7.4 Information Disclosure via Unfiltered API

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...

CVE-2026-72800 SiYuan before v3.7.4 Information Disclosure via Unfiltered API

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...

CVE-2026-72795 SiYuan before v3.7.4 Information Disclosure via Embed Block

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

CVE-2026-72795 SiYuan before v3.7.4 Information Disclosure via Embed Block

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

CVE-2026-72795

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

CVE-2026-72795

SiYuan before v3.7.4 is affected by an information-disclosure flaw in embed blocks. The issue arises because getBlockDOMWithEmbed and getBlockDOMsWithEmbed do not properly filter embedded content by publish access, allowing an attacker to request published blocks containing embed queries to read ...

DRUPAL-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...

CVE-2026-68450

A flaw was found in the Linux kernel's btrfs filesystem. When the addrelocroot function attempts to insert a duplicate mapping node into the relocroottree, the newly allocated node is not properly freed. This oversight can lead to a memory leak, potentially causing resource exhaustion and a Denia...

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

PT-2026-76591

Name of the Vulnerable Software and Affected Versions Drupal Quick Tabs versions 0.0.0 through 4.3.1 Description An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants...