{"id":"CVE-2026-74904","kind":"vulnerability","aliases":["CVE-2026-74904","GHSA-4vpg-gwqq-w44c","GO-2026-6654"],"related":[],"title":"SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel","description":"SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.","summary":"SiYuan's kernel/api/block.go has 17 block metadata and content endpoints (including getRefText, checkBlockExist and getBlockBreadcrumb) that skip publish-access filtering. An anonymous reader of a published workspace can get text derived from private blocks, block structure, and whether arbitrary block IDs exist.","severity":"high","cvss":8.7,"epss":0.00449,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260804015139-bd067a4fe9b2"],"affected":"< 0.0.0-20260804015139-bd067a4fe9b2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","publish-mode","self-hosted","siyuan"],"not_affected_if":["publish-mode-disabled","version-3.7.4-or-later"],"how_to_check":"Check the SiYuan version against the affected Go module pseudo-version (before 0.0.0-20260804015139-bd067a4fe9b2, or before v3.7.4). Confirm whether publish mode is enabled on the instance.","fix":"Upgrade SiYuan to v3.7.4 or the fixed kernel module 0.0.0-20260804015139-bd067a4fe9b2 or later.","status":"open","published_at":"2026-08-18T12:19:30+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:44:07+00:00","updated_at":"2026-10-23T21:44:07+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T21:44:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade SiYuan to v3.7.4 or the fixed kernel module 0.0.0-20260804015139-bd067a4fe9b2 or later.","reach":"internet","impact":"medium","summary":"SiYuan's kernel/api/block.go has 17 block metadata and content endpoints (including getRefText, checkBlockExist and getBlockBreadcrumb) that skip publish-access filtering. An anonymous reader of a published workspace can get text derived from private blocks, block structure, and whether arbitrary block IDs exist.","category":"package","who_cares":["siyuan","self-hosted","publish-mode","go"],"confidence":0.75,"needs_auth":"no","worst_case":"Anonymous readers learn private block text fragments and block existence across the workspace.","analyst_note":"","how_to_check":"Check the SiYuan version against the affected Go module pseudo-version (before 0.0.0-20260804015139-bd067a4fe9b2, or before v3.7.4). Confirm whether publish mode is enabled on the instance.","needs_analyst":false,"not_affected_if":["publish-mode-disabled","version-3.7.4-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":3057,"output_tokens":847,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':26A,34A,37A '-6654':35A '-74904':27A,38A '/siyuan-note/siyuan/kernel':24A,41A '17':2A,55B,102C '4vpg':30A 'access':12A,70B,126C 'across':151C 'allow':128C 'anonym':16A,73B,129C 'arbitrari':90B,148C 'authent':120C 'author':99C 'basic':119C 'block':3A,56B,85B,86B,91B,103C,137C,149C 'check':100C 'checkblockexist':63B,110C 'content':59B,139C 'content-deriv':138C 'cve':25A,36A 'deriv':82B,140C 'disclos':135C 'endpoint':5A,60B,105C 'exist':93B,145C 'filter':13A,71B,127C 'gate':116C 'get':80B 'getblockbreadcrumb':65B,112C 'getreftext':62B,109C 'ghsa':29A 'ghsa-4vpg-gwqq-w44c':28A 'github.com':23A,40A 'github.com/siyuan-note/siyuan/kernel':22A,39A 'go':33A,42B 'gwqq':31A 'handler':114C 'host':49B 'id':92B,150C 'includ':61B,108C 'inform':146C 'kernel/api/block.go':7A,53B,107C 'lack':123C 'metadata':57B,143C 'metadata/content':4A,104C 'miss':98C 'mode':19A,46B,132C 'model.checkauth':121C 'packag':43B 'privat':84B,136C 'publish':11A,18A,45B,69B,77B,125C,131C 'publish-access':10A,68B,124C 'publish-mod':17A,44B,130C 'reachabl':14A 'reader':20A,74B,133C 'self':48B 'self-host':47B 'siyuan':1A,50B,51B,94C 'skip':67B 'structur':87B,142C 'text':81B,141C 'v3.7.4':96C 'w44c':32A 'whether':89B 'workspac':78B,153C 'zero':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-18T12:19:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6654","url":"https://pkg.go.dev/vuln/GO-2026-6654","severity":null,"published_at":"2026-10-07T14:10:14+00:00","modified_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-74904","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74904","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-74904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74904","severity":null,"published_at":"2026-08-18T12:19:30+00:00","modified_at":"2026-10-22T22:10:00+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}