https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T04:13:57.708436+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-72803 fkie_cve-2026-72803 2026-10-01T04:13:57.866512+00:00

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.

 https://vulnerability.circl.lu/vuln/ghsa-h4w7-mgq4-wg6x Withdrawn: GHSA-h4w7-mgq4-wg6x — Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (n… 2026-10-01T04:13:57.866637+00:00

Withdrawn by the publisher.

Affected: Go: github.com/siyuan-note/siyuan/kernel

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references.

## Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.