PT-2026-88947

CVE-2026-87809

·

Published

2026-09-09

·

Updated

2026-09-18

Description by

CVSS 4.0
7.1
High
MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Siyuan versions prior to 3.8.2
Description Insufficient publish-access filtering for embedded blocks occurs during rendering. Users with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents that contain embed queries selecting those blocks. This issue affects the '/api/export/preview' and '/api/lute/copyStdMarkdown' endpoints.
Recommendations Update to version 3.8.2 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2026-87809
GHSA-8WX4-FVQW-F5F8
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com