CVE-2026-74904 — SiYuan before v3.7.4 Missing Authorization via block API
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb…
Published: 2026-08-18 · CVSS: 8.7 · CVSS 4.0
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7