{"vulnerability": "ghsa-pm3w-vxp9-ccwc", "sightings": [{"uuid": "0b9c9159-ea83-4deb-872d-98f8a151d32c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pm3w-vxp9-ccwc", "type": "seen", "source": "https://gist.github.com/alon710/0a73f204f4113f41e2621c39634bb023", "content": "# CVE-2026-68585: CVE-2026-68585: Metadata Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68585\n\n## Summary\nA metadata disclosure vulnerability exists in SiYuan prior to version v3.7.3. The /api/block/getBlockInfo endpoint fails to validate authorization boundaries in publish mode, allowing anonymous readers to access private document metadata.\n\n## TL;DR\nUnauthenticated remote attackers can bypass authorization controls to exfiltrate private document metadata in SiYuan knowledge management servers by sending crafted API requests to /api/block/getBlockInfo.\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.8\n- **EPSS Score**: 0.00194 (Percentile: 9.16%)\n- **Impact**: Information Disclosure (Metadata Leakage)\n- **Exploit Status**: None / No Public PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < v3.7.3 (Fixed in: `v3.7.3`)\n\n## Mitigation\n\n- Upgrade to SiYuan v3.7.3 or later\n- Disable public publish mode to prevent unauthenticated access\n- Implement reverse proxy rules to block /api/block/getBlockInfo for external users\n\n**Remediation Steps:**\n1. Identify running SiYuan instances and verify their versions.\n2. Download and apply the upgrade package for version v3.7.3 or higher.\n3. If immediate upgrade is not possible, disable public publishing inside settings.\n4. Verify endpoint restriction by attempting anonymous API requests to the patched endpoints.\n\n## References\n\n- [GitHub Security Advisory GHSA-pm3w-vxp9-ccwc](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pm3w-vxp9-ccwc)\n- [VulnCheck Technical Advisory](https://www.vulncheck.com/advisories/siyuan-before-metadata-disclosure-via-getblockinfo)\n- [NVD Vulnerability Detail - CVE-2026-68585](https://nvd.nist.gov/vuln/detail/CVE-2026-68585)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68585) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T13:04:27.684632Z"}]}