https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:11:37 +0000 https://vulnerability.circl.lu/sighting/bbcff34c-39d4-4e87-9964-592768e6e783/export {"uuid": "bbcff34c-39d4-4e87-9964-592768e6e783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74904", "type": "seen", "source": "https://gist.github.com/alon710/47da12356e94a1dcc2ea8b033ffc5504", "content": "# CVE-2026-74904: CVE-2026-74904: Missing Authorization in SiYuan Note-Taking Application API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74904\n\n## Summary\nA high-severity missing authorization vulnerability (CWE-862) exists in the SiYuan note-taking application before v3.7.4. Seventeen block metadata and content-derived endpoints within kernel/api/block.go lack proper publish-access and role-based checks. This allows low-privilege or anonymous users in publish mode to bypass workspace restrictions and disclose private block content, trace workspace structures, map document indexes, and verify the existence of private notes. The vulnerability is addressed in version v3.7.4.\n\n## TL;DR\nUnauthenticated or anonymous users can exploit missing authorization checks in SiYuan's block APIs to retrieve private note contents and map document metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00504 (Percentile: 40.87%)\n- **Impact**: Information Disclosure\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note-Taking Application\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Disable Publish Mode entirely if upgrades cannot be performed\n- Restrict network access to port 6806 using firewall rules or a reverse proxy\n\n**Remediation Steps:**\n1. Verify the running version of SiYuan using the settings or API interface\n2. Download the latest version (v3.7.4 or later) from the official GitHub repository or update the container image\n3. Apply network access controls to ensure the backend port is not exposed directly to the public internet\n4. Configure a reverse proxy with path-based access controls to block unauthenticated requests to /api/block/*\n\n## References\n\n- [GitHub Security Advisory GHSA-4vpg-gwqq-w44c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c)\n- [Fix Commit bd067a4fe9b208c0858d8d9dc6220dc8affc403e](https://github.com/siyuan-note/siyuan/commit/bd067a4fe9b208c0858d8d9dc6220dc8affc403e)\n- [SiYuan Release v3.8.0](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n- [VulnCheck Advisory for SiYuan Note](https://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api)\n- [NVD CVE-2026-74904 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-74904)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T08:30:29.000000Z"} {"uuid": "bbcff34c-39d4-4e87-9964-592768e6e783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74904", "type": "seen", "source": "https://gist.github.com/alon710/47da12356e94a1dcc2ea8b033ffc5504", "content": "# CVE-2026-74904: CVE-2026-74904: Missing Authorization in SiYuan Note-Taking Application API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74904\n\n## Summary\nA high-severity missing authorization vulnerability (CWE-862) exists in the SiYuan note-taking application before v3.7.4. Seventeen block metadata and content-derived endpoints within kernel/api/block.go lack proper publish-access and role-based checks. This allows low-privilege or anonymous users in publish mode to bypass workspace restrictions and disclose private block content, trace workspace structures, map document indexes, and verify the existence of private notes. The vulnerability is addressed in version v3.7.4.\n\n## TL;DR\nUnauthenticated or anonymous users can exploit missing authorization checks in SiYuan's block APIs to retrieve private note contents and map document metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00504 (Percentile: 40.87%)\n- **Impact**: Information Disclosure\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note-Taking Application\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Disable Publish Mode entirely if upgrades cannot be performed\n- Restrict network access to port 6806 using firewall rules or a reverse proxy\n\n**Remediation Steps:**\n1. Verify the running version of SiYuan using the settings or API interface\n2. Download the latest version (v3.7.4 or later) from the official GitHub repository or update the container image\n3. Apply network access controls to ensure the backend port is not exposed directly to the public internet\n4. Configure a reverse proxy with path-based access controls to block unauthenticated requests to /api/block/*\n\n## References\n\n- [GitHub Security Advisory GHSA-4vpg-gwqq-w44c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c)\n- [Fix Commit bd067a4fe9b208c0858d8d9dc6220dc8affc403e](https://github.com/siyuan-note/siyuan/commit/bd067a4fe9b208c0858d8d9dc6220dc8affc403e)\n- [SiYuan Release v3.8.0](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n- [VulnCheck Advisory for SiYuan Note](https://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api)\n- [NVD CVE-2026-74904 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-74904)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T08:30:29.000000Z"} https://vulnerability.circl.lu/sighting/bbcff34c-39d4-4e87-9964-592768e6e783/export Sat, 03 Oct 2026 08:30:29 +0000