CyberRota Analysis
AI-GeneratedThe vulnerability affects SiYuan versions prior to 3.7.4, where 17 block metadata and content endpoints lack proper authorization checks, relying solely on basic authentication. This oversight allows unauthorized users to access and disclose private block content, structural metadata, and existence information for any block ID within the workspace. Organizations using SiYuan should prioritize patching this vulnerability to prevent potential data exposure and unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.