CVE-2026-101092

SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...

SUSE CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

PT-2026-85349

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs...

CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

CVE-2026-68587

SiYuan has a information-disclosure vulnerability affecting versions before v3.7.3. The flaw lies in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints, which return rendered block DOM without publish-access checks. Consequently, anonymous reade...

CVE-2026-68587: Missing Authorization

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

CVE-2026-68585: Missing Authorization

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...