{"vulnerability": "ghsa-vg99-7gj7-2fr5", "sightings": [{"uuid": "31a36881-c021-452f-9a36-038f9734d534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vg99-7gj7-2fr5", "type": "seen", "source": "https://gist.github.com/alon710/7d7216991d5991995a78544517969a95", "content": "# CVE-2026-73606: CVE-2026-73606: Authorization Bypass and Information Disclosure in SiYuan /api/block/getRefIDs Endpoint\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73606\n\n## Summary\nAn authorization bypass and information disclosure vulnerability in the SiYuan personal knowledge management system before version 3.7.4 allows unauthenticated attackers to query block relationship metadata from password-protected documents.\n\n## TL;DR\nUnauthenticated API requests to `/api/block/getRefIDs` bypass password checks, leaking relationship hierarchies in SiYuan.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00325 (Percentile: 23.20%)\n- **Exploit Status**: None (No public exploit)\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: kernel/api/block.go (/api/block/getRefIDs)\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan kernel to v3.7.4 or later.\n- Disable anonymous publish mode if immediate upgrade is not feasible.\n- Enforce IP-level access controls to the SiYuan kernel api endpoint.\n\n**Remediation Steps:**\n1. Verify the currently deployed SiYuan version.\n2. Update deployment configurations (Docker Compose, systemd, or native binaries) to reference v3.7.4 or later.\n3. Test endpoint response behavior by issuing unauthenticated POST requests to /api/block/getRefIDs to confirm password-protected paths return filtered results.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vg99-7gj7-2fr5)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getrefids)\n- [NIST National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-73606)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-73606)\n- [SiYuan Repository](https://github.com/siyuan-note/siyuan)\n- [SiYuan v3.8.0 Release Notes](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73606) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T17:30:31.000000Z"}]}