CVE-2026-87810: Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SiYuan instances running a version before 3.8.2 that allow unauthenticated access in publish mode are exposed. An unauthenticated publish-mode reader can query the affected search endpoint.
What does an attacker need to exploit it?
The attacker needs network access to the SiYuan instance and the ability to send POST requests to /api/search/fullTextSearchBlock. No authentication, privileges, or user interaction are required.
What information can be disclosed?
The endpoint does not return private blocks themselves, but its unfiltered match counts reveal whether chosen search terms occur in hidden or unpublished documents. The counts can disclose the number of matching blocks and pages.
How can the issue be mitigated if upgrading is not immediately possible?
Restrict or disable unauthenticated publish-mode access so untrusted users cannot submit searches to the affected endpoint. Limiting network access to trusted users also reduces exposure.
How can administrators determine whether they are affected?
Check whether the instance is running a version before 3.8.2 and exposes publish mode to unauthenticated readers. On an affected instance, searches through the endpoint may show match counts for terms that exist only in hidden or unpublished content.