CVE-2026-93921: Siyuan-Note Siyuan

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

Affected products

• Siyuan-Note Siyuan: up to and including 3.8.4

Published 2026-09-19. Last modified 2026-09-21.