CVE-2026-87809 — Siyuan before v3.8.2 Information Disclosure via Export Preview
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers wi…
Published: 2026-09-09 · CVSS: 7.1 · CVSS 4.0
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7