CVE-2026-74904 SiYuan before v3.7.4 Missing Authorization via block API
Attackers can read private block content and metadata in SiYuan when publish mode is enabled due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74904?
CVE-2026-74904 is a high-severity missing authorization vulnerability in siyuan-note siyuan, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
Weakness: CWE-862
Which versions are affected by CVE-2026-74904?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260804015139-bd067a4fe9b2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260804015139-bd067a4fe9b2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260804015139-bd067a4fe9b2 |
How do I fix CVE-2026-74904?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260804015139-bd067a4fe9b2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-74904 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74904 exists.
Sources
Also known as GHSA-4vpg-gwqq-w44c, GO-2026-6654.