VulnerabilityDeferred

CVE-2026-72803

Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.

MEDIUM 6.9EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: disclosure@vulncheck.com

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378
https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.