Live › vulnerability › CVE-2026-74904
Go to dashboardSiYuan's kernel/api/block.go has 17 block metadata and content endpoints (including getRefText, checkBlockExist and getBlockBreadcrumb) that skip publish-access filtering. An anonymous reader of a published workspace can get text derived from private blocks, block structure, and whether arbitrary block IDs exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260804015139-bd067a4fe9b2 | 0.0.0-20260804015139-bd067a4fe9b2 |
v3.7.4)Upgrade SiYuan to v3.7.4 or the fixed kernel module 0.0.0-20260804015139-bd067a4fe9b2 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
This page as .md · .json · in your agent: get_signal("CVE-2026-74904")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.