Siyuan EUVD-2026-74835

Exploitation requires a valid reader-level authenticated session on the target Siyuan instance - unauthenticated access is insufficient (CVSS PR:L). The deployment must have multi-user access configured with at least one user whose access level is lower than the owner of the private content. The attacker must be able to submit or access a document containing an embed block query that references private or publish-disabled block IDs, and must be able to invoke the /api/export/preview or /api/lute/copyStdMarkdown endpoints. Single-user deployments with no external reader accounts are not exposed. The vulnerability does not permit write access, code execution, or availability disruption - impact is strictly bounded to confidentiality of block content.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately captures the threat model: low-complexity network exploitation by any authenticated reader with high confidentiality impact and no integrity or availability consequences. The real-world risk is most acute in multi-user or team deployments of Siyuan where content owners use privacy controls to segregate sensitive notes (drafts, private journals, restricted project data) from shared spaces. Single-user self-hosted instances with no external reader accounts carry negligible exposure. No EPSS data is available in the provided input. Neither a public exploit nor a KEV listing has been identified, consistent with the product's niche deployment footprint. The low attack complexity and absence of any special configuration requirement beyond having a reader account mean that any authorized reader on a vulnerable multi-user instance can trivially exploit this.

An authenticated reader on a shared Siyuan instance creates or locates a public document and inserts an embed block whose query selects blocks belonging to a private notebook or a publish-disabled page. The reader then issues a GET or POST request to /api/export/preview referencing that document, and the response contains the fully rendered content of the private blocks - including text, attachments, and metadata the owner intended to restrict. No proof-of-concept code has been publicly disclosed, but the attack requires only reader credentials and a standard HTTP client.