SiYuan EUVD-2026-57810

The target SiYuan instance must be running a version prior to v3.7.4 and its API port must be network-reachable by the attacker. The vulnerability specifically manifests against documents that have been configured with SiYuan's built-in document password protection - this is the feature that is bypassed. No authentication to SiYuan itself is required (PR:N in the CVSS 4.0 vector), and no user interaction is needed. The disclosed information is limited to block identifiers and reference relationships, not the textual content of the protected documents. Exploitation is bounded to deployments where the API is internet-exposed; instances bound to localhost or protected by network controls are not remotely exploitable.

The CVSS 4.0 base score of 6.9 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) vulnerability with limited confidentiality impact on both the vulnerable system (VC:L) and subsequent system (SC:L). The practical impact is restricted to metadata leakage - block identifiers and cross-document reference relationships - not the actual contents of password-protected documents. There is no CISA KEV listing and no publicly available exploit code confirmed at time of analysis, which materially reduces real-world urgency compared to a fully weaponized flaw. EPSS data was not included in available intelligence, so exploitation probability cannot be independently quantified. SiYuan is typically self-hosted by individuals or small teams, and the realistic threat surface consists primarily of internet-facing deployments; even a mid-sized municipal IT team in mielec running SiYuan internally behind a firewall would face negligible external exposure. Organizations that expose SiYuan's API port to the public internet should prioritize patching, since the attack requires no credentials and no user interaction, but this is a low-severity information disclosure rather than a code execution or data exfiltration risk.

An unauthenticated remote attacker sends an HTTP request to the /api/block/getRefIDs endpoint of an internet-facing SiYuan instance, supplying one or more block IDs obtained through any means such as guessing or prior enumeration. The server responds with block reference identifiers from password-protected documents without verifying whether the requester has the document password, revealing which blocks are referenced within sensitive documents. The attacker can repeat this process to map the internal document relationship graph, enabling reconnaissance of document structures the attacker is not authorized to access.