CVE-2026-105205

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5

Description An information disclosure issue allows readers in publish-mode to obtain backlink block IDs and reference counts from documents that are password-protected or have publishing disabled. This occurs when a published document is queried, bypassing the confidentiality boundary. An attacker can send POST requests to the endpoints '/api/block/getDocInfo' or '/api/block/getDocsInfo' using a published document ID to retrieve the refIDs and refCount of hidden referencing blocks.

Recommendations Update SiYuan to version 3.8.5 or later. Restrict access to the '/api/block/getDocInfo' and '/api/block/getDocsInfo' endpoints to minimize the risk of information disclosure.