CVE-2026-87810 siyuan-note CVE debrief

Who should care

Defenders responsible for Siyuan deployments, especially those with unpublished or sensitive content, should assess exposure and prioritize verification and potential remediation. Defenders need to verify the presence of this vulnerability in their inventory to assess exposure. Unauthenticated readers can determine the existence of hidden content, potentially aiding further attacks. The vulnerability may allow attackers to gather information about and

Why it matters

CVE-2026-87810 is a medium-severity information disclosure vulnerability in Siyuan before v3.8.2. Defenders should prioritize verifying inventory, assessing exposure, and considering remediation, especially in deployments with sensitive content.

• Defenders need to verify the presence of this vulnerability in their inventory to assess exposure.
• Unauthenticated readers can determine the existence of hidden content, potentially aiding further attacks.
• The vulnerability may allow attackers to gather information about sensitive or unpublished content.
• Remediation priority should be set based on the sensitivity of content stored in Siyuan deployments.

Technical summary

The vulnerability exists in the POST /api/search/fullTextSearchBlock endpoint of Siyuan before v3.8.2. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages. This information disclosure vulnerability allows defenders to assess exposure and prioritize verification and potential remediation, especially in deployments with sensitive content. Affected product deployments should be verified for exposure, and remediation should be prioritized based on the sensitivity of content stored in Siyuan deployments.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing exposure, especially in deployments where unpublished or sensitive content is stored.

Recommended defensive actions

• Verify the presence of Siyuan in your inventory and assess exposure, especially in deployments with unpublished or sensitive content.
• Review access controls and authentication mechanisms for the affected endpoint.
• Consider upgrading to Siyuan v3.8.2 or later if available.
• Monitor for potential abuse of the fullTextSearchBlock endpoint.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the exact scope of affected deployments and the number of potentially exposed instances require further verification and defensive assessment. Defenders should verify inventory, assess exposure, and consider remediation, especially in deployments with sensitive content. The information disclosure vulnerability allows unauthenticated publish-mode readers to submit arbitrary search terms and learn whether matching content exists in hidden or unpublished and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.