SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-…
High CVSS 7.5
Summary
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/siyuan-note/siyuan/issues/17246 Issue Tracking
- https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 Release Notes
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q Exploit
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q Exploit
Timeline
- nvd_ingest NVD