---
id: "CVE-2026-74904"
kind: "vulnerability"
aliases: ["CVE-2026-74904", "GHSA-4vpg-gwqq-w44c", "GO-2026-6654"]
title: "SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel"
severity: "high"
cvss: 8.7
epss: 0.00449
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["0.0.0-20260804015139-bd067a4fe9b2"], "affected": "< 0.0.0-20260804015139-bd067a4fe9b2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "publish-mode", "self-hosted", "siyuan"]
not_affected_if: ["publish-mode-disabled", "version-3.7.4-or-later"]
published_at: "2026-08-18T12:19:30+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:44:07+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6654", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-74904", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74904", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel

SiYuan's kernel/api/block.go has 17 block metadata and content endpoints (including getRefText, checkBlockExist and getBlockBreadcrumb) that skip publish-access filtering. An anonymous reader of a published workspace can get text derived from private blocks, block structure, and whether arbitrary block IDs exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 0.0.0-20260804015139-bd067a4fe9b2 fixed 0.0.0-20260804015139-bd067a4fe9b2

## How to check

Check the SiYuan version against the affected Go module pseudo-version (before 0.0.0-20260804015139-bd067a4fe9b2, or before v3.7.4). Confirm whether publish mode is enabled on the instance.

## Fix

Upgrade SiYuan to v3.7.4 or the fixed kernel module 0.0.0-20260804015139-bd067a4fe9b2 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6654
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-74904
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74904

## From the sources

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_