{"id":"EUVD-2026-60585","enisaUuid":"867b9b91-5cb0-365b-8792-54fc8139e4dc","description":"SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.","datePublished":"Aug 18, 2026, 11:19:36 AM","dateUpdated":"Aug 18, 2026, 3:04:46 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c\nhttps://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api\n","aliases":"CVE-2026-74904\nGHSA-69jp-f2p8-9vrg\nGHSA-4vpg-gwqq-w44c\n","assigner":"VulnCheck","epss":0.45,"enisaIdProduct":[{"id":"ef7aabff-e7bc-3b60-8d99-3f0b943c7c44","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.4"}],"enisaIdVendor":[{"id":"faf90bba-5501-3445-83b9-65e1899e2f4c","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"8b30af03-7b26-3c7a-a37a-dd974874a777","vulnerability":{"id":"GHSA-69jp-f2p8-9vrg","description":"Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers","datePublished":"Aug 18, 2026, 12:31:21 PM","dateUpdated":"Oct 2, 2026, 10:56:13 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74904\nhttps://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api\n","enisa_id":"EUVD-2026-60585\n","aliases":"GHSA-69jp-f2p8-9vrg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b5a37982-287c-3f2b-b080-93afbc17cc39","vulnerability":{"id":"CVE-2026-74904","description":"SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.","datePublished":"Aug 18, 2026, 11:19:36 AM","dateUpdated":"Aug 18, 2026, 3:04:46 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c\nhttps://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api\n","enisa_id":"EUVD-2026-60585\n","assigner":"VulnCheck","epss":0.45,"dataProcessed":"Nov 1, 2026, 7:15:04 AM","vulnerabilityProduct":[{"id":"e536e8b5-1ef4-3b19-a7af-018b32cc81c7","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.4"}],"vulnerabilityVendor":[{"id":"6f243e5d-e25e-3d8d-a679-f6c28265a81e","vendor":{"name":"siyuan-note"}}]}},{"id":"e843dcb3-505f-325d-b99a-a43519bf2829","vulnerability":{"id":"GHSA-4vpg-gwqq-w44c","description":"SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers","datePublished":"Oct 2, 2026, 11:05:33 PM","dateUpdated":"Oct 2, 2026, 11:05:33 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74904\nhttps://github.com/siyuan-note/siyuan/commit/bd067a4fe9b208c0858d8d9dc6220dc8affc403e\nhttps://github.com/siyuan-note/siyuan\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.8.0\nhttps://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api\n","enisa_id":"EUVD-2026-60585\n","aliases":"GHSA-4vpg-gwqq-w44c\nCVE-2026-74904\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}