GHSA-qvq9-hq6p-v378: Medium severity go/github.com/siyuan-note/siyuan/kernel vulnerability
CVE: This vulnerability corresponds to CVE-2026-72803.
Summary
POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set (IAL) with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives the block's name, alias, memo, bookmark, tags, and every custom- attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.
Details
Neither handler applies a filter:
go // /api/attr/getBlockAttrs (router line 301) ret.Data = sql.GetBlockAttrs(id)
// /api/attr/batchGetBlockAttrs (router line 302) ret.Data = sql.BatchGetBlockAttrs(idList)
sql.GetBlockAttrs is a direct database read returning the block's entire IAL: name, alias, memo, bookmark, tags, and any custom- key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.
batchGetBlockAttrs takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.
Guarded-sibling asymmetry. The sibling metadata endpoint getBlockInfo calls checkBlockPublishAccess(c, id, ret) before returning; getBlockAttrs and batchGetBlockAttrs call nothing.
Verified at origin/master: both handler bodies contain no publish-access, publish-ignore, or readonly-role check, and both routes are registered CheckAuth without CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. A document is marked publish-forbidden (or password-protected) and contains a block with a memo and a custom attribute set.
Single-block disclosure: POST http://127.0.0.1:6808/api/attr/getBlockAttrs {"id":"<BLOCKIDINPROTECTEDDOC>"} Returns the block's IAL: name, alias, memo, bookmark, tags, and all custom- values.
Bulk disclosure: POST http://127.0.0.1:6808/api/attr/batchGetBlockAttrs {"ids":["<ID1>","<ID2>","<ID3>"]} Returns the attribute sets for every supplied ID in one response, with no per-ID authorization.
Control: the sibling getBlockInfo with the same block ID is refused by checkBlockPublishAccess, confirming the boundary is enforced elsewhere and omitted here.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read block attributes belonging to publish-forbidden and password-protected documents, including user-authored memos and arbitrary custom- values. The batch endpoint turns this into a bulk primitive: given a set of block IDs, an attacker retrieves attributes across the whole workspace in a single request. Confidentiality-only.
Suggested fix
Call checkBlockPublishAccess in getBlockAttrs before returning, matching getBlockInfo. For batchGetBlockAttrs, apply the check per ID and drop unauthorized entries from the response rather than failing the whole batch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/siyuan-note/siyuan/kernelto a version that resolves this vulnerability.Fixed in 0.0.0-20260724093256-229fdffd7e4a - Configuration
Update handler implementations for /api/attr/getBlockAttrs and /api/attr/batchGetBlockAttrs to call checkBlockPublishAccess(c, id, ret) before returning block attributes. For batchGetBlockAttrs, apply the check per supplied ID and drop unauthorized entries from the response rather than failing the whole batch.
Block attributes endpoints (/api/attr/getBlockAttrs and /api/attr/batchGetBlockAttrs) checkBlockPublishAccess enforcement = true - Compensating control
As an additional mitigation, avoid exposing these attribute endpoints to anonymous users by enabling Publish.Auth (i.e., set Publish.Auth.Enable to true) so that only authenticated publish readers can reach routes guarded by CheckAuth.
Event History
Frequently Asked Questions
Who can access the affected endpoints?
The endpoints are reachable by a publish RoleReader token. They are also reachable by an anonymous account when Publish.Auth.Enable is false.
What does an attacker need to retrieve attribute data?
An attacker needs to supply a block ID to the single-block endpoint. The batch endpoint accepts a list of block IDs, allowing bulk retrieval when multiple IDs are known.
Are publish-forbidden or password-protected documents protected from this disclosure?
No. The endpoints return attributes for blocks in publish-forbidden and password-protected documents because they do not apply a publish-access filter.
What information can be exposed through the attribute response?
Responses can include a block's name, alias, memo, bookmark, tags, and all custom-* attributes. Memos and custom attributes may contain user-authored free-text information.