Unauthorized Access in SiYuan's Block Metadata API

CVE-2026-74904

What is CVE-2026-74904?

SiYuan versions prior to v3.7.4 exhibit a critical security flaw where multiple block metadata endpoints in the API lack proper authorization checks. Specifically, the endpoint functions rely solely on basic authentication and do not implement necessary publish-access filtering. This oversight can result in unauthorized access, allowing anonymous users in publish mode to access and disclose sensitive content, including private block text and structural metadata, as well as information about the existence of arbitrary block IDs within the workspace.

References