CVE-2026-74904 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments, especially those with anonymous publish-mode readers, should assess exposure and prioritize verification and potential compensating controls.

Why it matters

CVE-2026-74904 is a missing authorization vulnerability in SiYuan's kernel/api/block.go, allowing anonymous publish-mode readers to access block metadata and content. Defenders should prioritize verifying exposure, assessing compensating controls, and updating access controls.

• Potential unauthorized access to block metadata and content
• Possible exposure of sensitive information
• Need for verification of deployment exposure
• Priority for updating access controls

Technical summary

The vulnerability is caused by 17 handlers in `kernel/api/block.go` having no access checks, gated only by `model.CheckAuth` with no admin-role requirement, allowing anonymous publish-mode readers to access block content-derived text, structural metadata, or existence information for any block ID supplied. This allows potential unauthorized access to block metadata and content, possible exposure of sensitive information, and the need for verification of deployment exposure and updating access controls. The source corpus provides details on these handlers with missing authorization.

Defensive priority

Defenders should prioritize verifying exposure for SiYuan deployments, especially those with anonymous publish-mode readers, and assess the need for compensating controls or inventory checks.

Recommended defensive actions

• Verify SiYuan deployments for exposure, especially those with anonymous publish-mode readers
• Assess the need for compensating controls or inventory checks
• Review and update access controls for block metadata and content endpoints
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides details on 17 handlers in `kernel/api/block.go` with missing authorization, gated only by `model.CheckAuth` with no admin-role requirement, returning block content-derived text, structural metadata, or existence information for any block ID supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.