Information Disclosure Vulnerability in Siyuan by Siyuan Note

CVE-2026-87810

What is CVE-2026-87810?

In Siyuan prior to version 3.8.2, an information disclosure vulnerability exists within the POST /api/search/fullTextSearchBlock endpoint. This flaw allows unauthenticated users in publish mode to submit arbitrary search terms. While the system correctly filters private blocks from the search results, it inadvertently reveals unfiltered match counts, enabling unauthorized users to ascertain the existence of hidden or unpublished content. This behavior potentially exposes sensitive data regarding private notes and documents, increasing the risk of information leakage.

References