CVE-2026-87809 siyuan-note CVE debrief

Who should care

Defenders of Siyuan instances, particularly those with public documents containing embedded blocks, should assess exposure and restrict access to sensitive blocks. This includes verifying the exposure of Siyuan instances to public documents with embedded blocks, restricting access to sensitive blocks, and monitoring for suspicious access to public documents.

Why it matters

CVE-2026-87809 allows attackers with reader access to retrieve full rendered content of private, hidden, or publish-disabled blocks via public documents containing embed queries, requiring defenders to verify exposure and restrict access.

• Potential unauthorized access to sensitive information
• Need to verify exposure of Siyuan instances
• Possible data leakage through public documents

Technical summary

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. This allows attackers with reader access to retrieve the full rendered content of private, hidden, or publish-disabled blocks via public documents containing embed queries. The vulnerability affects Siyuan instances with public documents containing embedded blocks, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying exposure of Siyuan instances to public documents with embedded blocks and restrict access to sensitive blocks.

Defensive priority

Defenders should prioritize verifying exposure of Siyuan instances to public documents with embedded blocks and restrict access to sensitive blocks.

Recommended defensive actions

• Verify exposure of Siyuan instances to public documents with embedded blocks
• Restrict access to sensitive blocks
• Monitor for suspicious access to public documents
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor remediation and affected versions require verification. The vulnerability was publicly disclosed on 2026-09-09 and has not been modified since then. There are no known exploits or additional details available beyond the CVE and NVD entries. Defenders should verify the exposure of Siyuan instances to public documents with embedded blocks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.