CVE-2026-72803: SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents
POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block’s full attribute set (IAL) with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives the block’s name, alias, memo, bookmark, tags, and every custom-* attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.
References
- github.com/advisories/GHSA-qvq9-hq6p-v378
- github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400
- github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378
- nvd.nist.gov/vuln/detail/CVE-2026-72803
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs
Code Behaviors & Features
Detect and mitigate CVE-2026-72803 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →