CVE-2026-74904: Siyuan-Note Siyuan

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.

Affected products

• Siyuan-Note Siyuan: before 3.7.4 (fixed in 3.7.4)

Published 2026-08-18. Last modified 2026-08-26.