{"vulnerability": "cve-2026-72803", "sightings": [{"uuid": "506aba9c-628d-4d43-bcc0-ffef6b1656ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72803", "type": "seen", "source": "https://gist.github.com/alon710/6d84a03746a753dea4049dd4a31c2df7", "content": "# CVE-2026-72803: CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72803\n\n## Summary\nAn information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.\n\n## TL;DR\nUnauthenticated remote attackers can bypass document-level protection rules (such as passwords or disabled-publish states) to read sensitive block metadata by directly querying the `getBlockAttrs` and `batchGetBlockAttrs` endpoints with known block IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237 (0.237%)\n- **Impact**: Partial Confidentiality Loss\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later.\n- Restrict access to vulnerable API endpoints via reverse proxy rules.\n- Avoid storing highly sensitive credentials or text within block attributes.\n\n**Remediation Steps:**\n1. Verify the current version of the SiYuan container or executable.\n2. Pull the latest Docker image of SiYuan (v3.7.4+) or update the application binaries.\n3. Restart the service to apply the patch.\n4. If upgrading is delayed, configure Nginx or Caddy reverse proxies to return HTTP 403 for POST requests to `/api/attr/getBlockAttrs` and `/api/attr/batchGetBlockAttrs` from untrusted IP spaces.\n\n## References\n\n- [SiYuan Security Advisory GHSA-qvq9-hq6p-v378](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378)\n- [VulnCheck Security Advisory Page](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs)\n- [Official Patch Commit](https://github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72803) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T23:31:29.854308Z"}, {"uuid": "ebd1707d-2b93-472d-ae39-d99d5731d16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72803", "type": "seen", "source": "https://gist.github.com/alon710/6d84a03746a753dea4049dd4a31c2df7", "content": "# CVE-2026-72803: CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72803\n\n## Summary\nAn information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.\n\n## TL;DR\nUnauthenticated remote attackers can bypass document-level protection rules (such as passwords or disabled-publish states) to read sensitive block metadata by directly querying the `getBlockAttrs` and `batchGetBlockAttrs` endpoints with known block IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237 (0.237%)\n- **Impact**: Partial Confidentiality Loss\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later.\n- Restrict access to vulnerable API endpoints via reverse proxy rules.\n- Avoid storing highly sensitive credentials or text within block attributes.\n\n**Remediation Steps:**\n1. Verify the current version of the SiYuan container or executable.\n2. Pull the latest Docker image of SiYuan (v3.7.4+) or update the application binaries.\n3. Restart the service to apply the patch.\n4. If upgrading is delayed, configure Nginx or Caddy reverse proxies to return HTTP 403 for POST requests to `/api/attr/getBlockAttrs` and `/api/attr/batchGetBlockAttrs` from untrusted IP spaces.\n\n## References\n\n- [SiYuan Security Advisory GHSA-qvq9-hq6p-v378](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378)\n- [VulnCheck Security Advisory Page](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs)\n- [Official Patch Commit](https://github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72803) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T00:00:27.236655Z"}, {"uuid": "0c0ab12b-bf10-4dd7-94fa-acbed079c5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72803", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-qvq9-hq6p-v378", "content": "", "creation_timestamp": "2026-09-04T00:35:10.411655Z"}]}