CVE-2026-74904: SiYuan before v3.7.4 Missing Authorization via block API
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Instances running a version before v3.7.4 are affected when anonymous users can access the application's publish mode. The exposed endpoints can reveal private block-derived text, structural metadata, and whether arbitrary block IDs exist elsewhere in the workspace.
What does an attacker need to exploit it?
An attacker needs network access to the affected SiYuan instance and access as an anonymous publish-mode reader. No authenticated account, user interaction, or special privileges are required.
Is a default access configuration affected?
Yes. The affected handlers enforce only basic authentication through model.CheckAuth and do not apply publish-access filtering, so publish-mode access can reach data that should remain private.
What can be done until the instance is upgraded?
If upgrading is not immediately possible, prevent anonymous access to publish mode or otherwise restrict network access to the SiYuan instance. This reduces the ability of unauthenticated publish-mode readers to query the affected block endpoints.