CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

EUVD-2026-57463

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

CVE-2026-72803

SiYuan before v3.7.4 fails to enforce publish-access checks in getBlockAttrs and batchGetBlockAttrs. An attacker can retrieve block attributes (names, aliases, memos, custom fields) from protected documents by sending POST requests with block IDs. Affected: SiYuan

CVE-2026-72803 SiYuan before v3.7.4 Information Disclosure via getBlockAttrs

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...