https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T04:11:49.193697+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352753 EUVD-2026-352753 2026-10-09T04:11:49.244438+00:00 EUVD-2026-352753 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72795 fkie_cve-2026-72795 2026-10-09T04:11:49.244482+00:00

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.

 https://cve.radiocsirt.org/vuln/ghsa-h6w7-xxcf-w2mq GHSA-h6w7-xxcf-w2mq — SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and passwor… 2026-10-09T04:11:49.244518+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

**CVE:** This vulnerability corresponds to [CVE-2026-72795](https://nvd.nist.gov/vuln/detail/CVE-2026-72795).

### Summary

`/api/block/getBlockDOMWithEmbed` and `/api/block/getBlockDOMsWithEmbed` gate only the *requested* block against publish access. The blocks pulled in by that block's embed (transclusion) query are inlined into the returned DOM with no publish-access check at all, so a reader who requests a legitimately-published block containing an embed query receives the content of every block that query matched including blocks in hidden, forbidden and password-protected documents.

The dedicated embed endpoint `getEmbedBlock` filters these same results for reader roles. The DOM-with-embed path does not.

### Details

| Item | Detail | |---|---| | Routes | `kernel/api/router.go:226` `POST /api/block/getBlockDOMWithEmbed` → `model.CheckAuth` → `getBlockDOMWithEmbed`; `:227` `POST /api/block/getBlockDOMsWithEmbed` → `model.CheckAuth` → `getBlockDOMsWithEmbed` | | Middleware | `CheckAuth` only — no `CheckReadonly`, no `CheckAdminRole` → reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is `false` | | Guard present | Top-level requested block only. Singular: password + disable checks on the requested id. Plural: `filterBlockDOMsByPublishAccess` over the requested ids. | | Guard absent | The embedded blocks resolved from the query | | Exposed | Content HTML of every block matched by the embed query, regardless of that block's publish…