CVE-2026-72795: SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
/api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed gate only the requested block against publish access. The blocks pulled in by that block’s embed (transclusion) query are inlined into the returned DOM with no publish-access check at all, so a reader who requests a legitimately-published block containing an embed query receives the content of every block that query matched including blocks in hidden, forbidden and password-protected documents.
The dedicated embed endpoint getEmbedBlock filters these same results for reader roles. The DOM-with-embed path does not.
References
- github.com/advisories/GHSA-h6w7-xxcf-w2mq
- github.com/siyuan-note/siyuan/commit/1ca1c3c9d94bea14fc9728ff2fb8392bb0f29732
- github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mq
- nvd.nist.gov/vuln/detail/CVE-2026-72795
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-embed-block
Code Behaviors & Features
Detect and mitigate CVE-2026-72795 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →