GHSA-QVQ9-HQ6P-V378
Vulnerability from github – Published: 2026-09-03 22:58 – Updated: 2026-09-03 22:58CVE: This vulnerability corresponds to CVE-2026-72803.
Summary
POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set (IAL) with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives the block's name, alias, memo, bookmark, tags, and every custom-* attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.
Details
Neither handler applies a filter:
// /api/attr/getBlockAttrs (router line 301)
ret.Data = sql.GetBlockAttrs(id)
// /api/attr/batchGetBlockAttrs (router line 302)
ret.Data = sql.BatchGetBlockAttrs(idList)
sql.GetBlockAttrs is a direct database read returning the block's entire IAL: name, alias, memo, bookmark, tags, and any custom-* key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.
batchGetBlockAttrs takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.
Guarded-sibling asymmetry. The sibling metadata endpoint getBlockInfo calls checkBlockPublishAccess(c, id, ret) before returning; getBlockAttrs and batchGetBlockAttrs call nothing.
Verified at origin/master: both handler bodies contain no publish-access, publish-ignore, or readonly-role check, and both routes are registered CheckAuth without CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. A document is marked publish-forbidden (or password-protected) and contains a block with a memo and a custom attribute set.
Single-block disclosure:
POST http://127.0.0.1:6808/api/attr/getBlockAttrs
{"id":"<BLOCK_ID_IN_PROTECTED_DOC>"}
Returns the block's IAL: name, alias, memo, bookmark, tags, and all custom-* values.
Bulk disclosure:
POST http://127.0.0.1:6808/api/attr/batchGetBlockAttrs
{"ids":["<ID1>","<ID2>","<ID3>"]}
Returns the attribute sets for every supplied ID in one response, with no per-ID authorization.
Control: the sibling getBlockInfo with the same block ID is refused by checkBlockPublishAccess, confirming the boundary is enforced elsewhere and omitted here.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read block attributes belonging to publish-forbidden and password-protected documents, including user-authored memos and arbitrary custom-* values. The batch endpoint turns this into a bulk primitive: given a set of block IDs, an attacker retrieves attributes across the whole workspace in a single request. Confidentiality-only.
Suggested fix
Call checkBlockPublishAccess in getBlockAttrs before returning, matching getBlockInfo. For batchGetBlockAttrs, apply the check per ID and drop unauthorized entries from the response rather than failing the whole batch.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260724093256-229fdffd7e4a"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-72803"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-03T22:58:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "**CVE:** This vulnerability corresponds to [CVE-2026-72803](https://nvd.nist.gov/vuln/detail/CVE-2026-72803).\n\n### Summary\n\n`POST /api/attr/getBlockAttrs` and `POST /api/attr/batchGetBlockAttrs` return a block\u0027s full attribute set (IAL) with no publish-access check. Both are `CheckAuth`-only, so they are reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. An anonymous reader supplying a block ID receives the block\u0027s name, alias, memo, bookmark, tags, and every `custom-*` attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.\n\n### Details\n\nNeither handler applies a filter:\n\n```go\n// /api/attr/getBlockAttrs (router line 301)\nret.Data = sql.GetBlockAttrs(id)\n\n// /api/attr/batchGetBlockAttrs (router line 302)\nret.Data = sql.BatchGetBlockAttrs(idList)\n```\n\n`sql.GetBlockAttrs` is a direct database read returning the block\u0027s entire IAL: `name`, `alias`, `memo`, `bookmark`, `tags`, and any `custom-*` key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.\n\n`batchGetBlockAttrs` takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.\n\n**Guarded-sibling asymmetry.** The sibling metadata endpoint `getBlockInfo` calls `checkBlockPublishAccess(c, id, ret)` before returning; `getBlockAttrs` and `batchGetBlockAttrs` call nothing.\n\nVerified at `origin/master`: both handler bodies contain no publish-access, publish-ignore, or readonly-role check, and both routes are registered `CheckAuth` without `CheckAdminRole`.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. A document is marked publish-forbidden (or password-protected) and contains a block with a memo and a custom attribute set.\n\n**Single-block disclosure:**\n```\nPOST http://127.0.0.1:6808/api/attr/getBlockAttrs\n{\"id\":\"\u003cBLOCK_ID_IN_PROTECTED_DOC\u003e\"}\n```\nReturns the block\u0027s IAL: `name`, `alias`, `memo`, `bookmark`, `tags`, and all `custom-*` values.\n\n**Bulk disclosure:**\n```\nPOST http://127.0.0.1:6808/api/attr/batchGetBlockAttrs\n{\"ids\":[\"\u003cID1\u003e\",\"\u003cID2\u003e\",\"\u003cID3\u003e\"]}\n```\nReturns the attribute sets for every supplied ID in one response, with no per-ID authorization.\n\n**Control:** the sibling `getBlockInfo` with the same block ID is refused by `checkBlockPublishAccess`, confirming the boundary is enforced elsewhere and omitted here.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can read block attributes belonging to publish-forbidden and password-protected documents, including user-authored memos and arbitrary `custom-*` values. The batch endpoint turns this into a bulk primitive: given a set of block IDs, an attacker retrieves attributes across the whole workspace in a single request. Confidentiality-only.\n\n### Suggested fix\n\nCall `checkBlockPublishAccess` in `getBlockAttrs` before returning, matching `getBlockInfo`. For `batchGetBlockAttrs`, apply the check per ID and drop unauthorized entries from the response rather than failing the whole batch.",
"id": "GHSA-qvq9-hq6p-v378",
"modified": "2026-09-03T22:58:29Z",
"published": "2026-09-03T22:58:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72803"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.