Information Disclosure in Siyuan API Export and Markdown Copying
CVE-2026-87809

7.1HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87809?

Earlier versions of Siyuan, specifically prior to v3.8.2, contain a security flaw where access controls are not properly enforced for embedded blocks. This vulnerability allows attackers with reader access to bypass necessary restrictions and gain visibility into the full rendered content of private, hidden, or disabled blocks. This is achieved through public documents that include queries targeting these embedded blocks, leading to potential exposure of sensitive information via the /api/export/preview and /api/lute/copyStdMarkdown endpoints.

Affected Version(s)

siyuan 0 < 3.8.2

siyuan 3.8.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.