CVE-2026-34453 SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark
Unauthenticated users can read password-protected bookmarked content in SiYuan's publish service due to broken access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34453?
CVE-2026-34453 is a high-severity missing authorization vulnerability in B3log Siyuan, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.
Weakness: CWE-863
Which versions are affected by CVE-2026-34453?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | None |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
Products include B3log Siyuan.
How do I fix CVE-2026-34453?
Upgrade github.com/siyuan-note/siyuan/kernel to 3.6.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34453 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-c77m-r996-jr3q, GO-2026-5318.