CVE-2026-68585: SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo
SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as excluded from publishing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.3 - Compensating control
Restrict access to the /api/block/getBlockInfo endpoint so anonymous readers or RoleReader token users cannot reach it for documents with publish-forbidden/excluded publishing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68585?
The severity of CVE-2026-68585 is classified as medium with a score of 5.8.
How do I fix CVE-2026-68585?
To fix CVE-2026-68585, upgrade SiYuan to version 3.7.3 or later.
What does CVE-2026-68585 affect?
CVE-2026-68585 affects SiYuan versions before 3.7.3.
What type of vulnerability is CVE-2026-68585?
CVE-2026-68585 is a metadata disclosure vulnerability.
What can attackers do with CVE-2026-68585?
Attackers can use CVE-2026-68585 to access document root metadata for publish-forbidden documents without appropriate access checks.