Live › vulnerability › CVE-2026-73606
Go to dashboardSiYuan's /api/block/getRefIDs endpoint skips the password check on protected documents, so it reveals which password-protected documents reference a given block. An unauthenticated reader can learn block identifiers and that those documents exist without the document password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
Check the SiYuan version running on the server; versions before v3.7.4 (Go module pseudo-version before 0.0.0-20260812083335-251596fc0de2) are affected.
Upgrade SiYuan to v3.7.4 or later (module 0.0.0-20260812083335-251596fc0de2 or newer).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.
This page as .md · .json · in your agent: get_signal("CVE-2026-73606")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.