CVE-2026-68585: SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered
The /api/block/getBlockInfo endpoint returns document root metadata including the document title (rootTitle) for a block in a publish-forbidden document, with no publish-access check. Its sibling /api/block/getDocInfo applies the publish-access filter, getBlockInfo does not. Both are gated by CheckAuth only, so getBlockInfo is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
References
- github.com/advisories/GHSA-pm3w-vxp9-ccwc
- github.com/siyuan-note/siyuan/commit/ffde3b21eca49ae98828747ca126581a553cce8b
- github.com/siyuan-note/siyuan/security/advisories/GHSA-pm3w-vxp9-ccwc
- nvd.nist.gov/vuln/detail/CVE-2026-68585
- www.vulncheck.com/advisories/siyuan-before-metadata-disclosure-via-getblockinfo
Code Behaviors & Features
Detect and mitigate CVE-2026-68585 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →