CVE-2026-68585

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description An issue exists in the '/api/block/getBlockInfo' endpoint that allows the disclosure of document root metadata for documents marked as excluded from publishing. This occurs because the system fails to perform publish-access checks. Anonymous readers or users with publish RoleReader tokens can provide a block ID to retrieve the title, notebook, path, root ID, and icon of these restricted documents.

Recommendations Update SiYuan to version 3.7.3 or later. As a temporary mitigation, restrict access to the '/api/block/getBlockInfo' endpoint.