Medium severity5.8NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72805
CVE-2026-72805
Description
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260723163028-931ba693375e | 0.0.0-20260723163028-931ba693375e |
Affected products
2- Range: <v3.7.4
- ghsa-coordsRange: < 0.0.0-20260723163028-931ba693375e
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-67x2-mq63-v9vmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72805ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3fghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vmnvdWEB
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpointsnvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026