CVE-2026-72795
CRITICAL
CVSS 9.2
siyuan
Verified Advisory
Publish-access bypass in SiYuan embedded block endpoints (CVE-2026-72795)
The `/api/block/getBlockDOMWithEmbed` and `/api/block/getBlockDOMsWithEmbed` endpoints in SiYuan apply publish-access checks only to the directly requested block, not to any blocks inlined by that block's embed (transclusion) query. As a result, an anonymous reader or publish-role reader who requests a legitimately published block containing an embed query receives the full HTML content of every matched block, including content from hidden, forbidden, and password-protected documents, without authorization.
Affected versions:
- <=v3.7.2
We recommend updating to: v3.7.4.
CVSS 9.2 · our assessment: act_now
Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mq
Details: https://vuln.today/cve/CVE-2026-72795
Verified by vuln.today against published advisories.
Affected versions
- – <=v3.7.2
Fixed in: v3.7.4
More advisories for siyuan
- CVE-2026-73608 – Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)
- CVE-2026-72804 – Missing publish-password check in SiYuan graph API endpoints (CVE-2026-72804)
- CVE-2026-72794 – Session cookie signing key disclosure in siyuan via getConf endpoint (CVE-2026-72794)
- CVE-2026-72798 – Information disclosure in SiYuan publish-mode attribute view filter (CVE-2026-72798)
- CVE-2026-72793 – Sensitive configuration disclosure in SiYuan via /api/system/getConf (CVE-2026-72793)
- CVE-2026-72789 – Authorization bypass in SiYuan encrypted notebook publish access gate (CVE-2026-72789)
- CVE-2026-68584 – Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)
- CVE-2026-68586 – Publish-access bypass in SiYuan backlink content endpoints (CVE-2026-68586)