CVE-2026-72800

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Authenticated readers or anonymous users (when publish authentication is disabled) can exploit missing publish-access filtering across multiple endpoints. The endpoint '/api/av/getAttributeViewKeysByID' allows the retrieval of complete database column schemas, including column titles, user-authored descriptions, select-option vocabularies, and Sprig template expressions. This occurs because the handler fails to apply the same filtering used by its sibling endpoint, enabling access to schemas of databases in hidden, password-protected, or non-published documents.

Additionally, two other endpoints act as information oracles by enumerating block IDs across the entire workspace regardless of publish boundaries:

These ID oracles enable attackers to discover valid block identifiers, which can then be used to access content from restricted documents.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the '/api/av/getAttributeViewKeysByID', '/api/block/getBlockDefIDsByRefText', and '/api/block/getBlockRelevantIDs' endpoints.