CVE-2026-93921: SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4 - Compensating control
Mitigate by preventing access to the SiYuan getDynamicIcon endpoint (the dynamic icon endpoint) for users holding only read-only tokens, e.g., via network/ACL/WAF rules that block those requests until the access control bypass is fixed.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a read-only SiYuan token. The vulnerable endpoint is network-accessible and requires no user interaction.
What information can be exposed?
A read-only token holder can retrieve metadata for restricted documents, including block titles, names, aliases, and hierarchical paths. The provided information does not indicate exposure of full document contents.
Which deployments are affected?
SiYuan versions through 3.8.4 are affected. Deployments are exposed where read-only tokens exist and can reach the getDynamicIcon endpoint.