Medium severity5.8NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72803
CVE-2026-72803
Description
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260724093256-229fdffd7e4a | 0.0.0-20260724093256-229fdffd7e4a |
Affected products
1- Range: <v3.7.4
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-qvq9-hq6p-v378ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72803ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400ghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378nvdWEB
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrsnvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026