CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.7.3 are vulnerable to an authentication bypass that allows unauthorized access to password-protected documents through specific content-returning endpoints. This flaw enables anonymous attackers to exploit internal block IDs from accessible endpoints, leading to potential data exposure. Organizations using affected versions should prioritize remediation to safeguard sensitive content from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.