CVE-2026-72805: SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
Three block endpoints return document content snippets and metadata without any publish-access check, while their sibling getBlockInfo which returns comparable data does enforce one. All three are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives content and metadata belonging to publish-forbidden and password-protected documents.
References
- github.com/advisories/GHSA-67x2-mq63-v9vm
- github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f
- github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vm
- nvd.nist.gov/vuln/detail/CVE-2026-72805
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpoints
Code Behaviors & Features
Detect and mitigate CVE-2026-72805 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →