CVE-2026-72805

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Insufficient publish-access checks on the 'getBlockBreadcrumb', 'getRefText', and 'getBlockTreeInfos' endpoints allow the disclosure of protected document content and metadata. Anonymous readers or accounts with the RoleReader role can retrieve document titles, ancestor block content snippets, reference text, and path metadata for documents that are password-protected or forbidden from being published by providing specific block IDs.

Recommendations Update to version 3.7.4 or later.