CVE-2026-93921 — SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can …
Published: 2026-09-18 · CVSS: 5.3 · CVSS 4.0
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7