https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:02:21.133819+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352774 EUVD-2026-352774 2026-10-07T05:02:21.178211+00:00 EUVD-2026-352774 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73606 fkie_cve-2026-73606 2026-10-07T05:02:21.178246+00:00

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.

 https://cve.radiocsirt.org/vuln/ghsa-vg99-7gj7-2fr5 GHSA-vg99-7gj7-2fr5 — SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protec… 2026-10-07T05:02:21.178280+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

`/api/block/getRefIDs` filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a document's publish password learns that the document references a given block.

A function ten lines away in the same file does perform the full check, on the same input type.

### Details

**Route,** identical at `eef105683` (`kernel/api/router.go:235`) and dev `a7ae96ce` (`:245`):

```go ginServer.Handle("POST", "/api/block/getRefIDs", model.CheckAuth, getRefIDs) ```

No `CheckReadonly`, no `CheckAdminRole`.

**The filter chain.** `getRefIDs` (`kernel/api/block.go:631`) checks `isEncryptedNotebookDeniedForPublish`, calls `model.GetBlockRefsInBox`, then for read-only roles:

```go publishIgnore := model.GetInvisiblePublishAccess(publishAccess) refDefs, originalRefBlockIDs = model.FilterRefDefsByPublishIgnore(publishIgnore, refDefs) ```

`FilterRefDefsByPublishIgnore` (`kernel/model/publish_access.go:1324`) collects the reference and definition identifiers, resolves their block trees, and delegates the decision to `FilterBlockTreesByPublishIgnore` (`:1314`), whose entire body is:

```go for id, bt := range bts { if CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { ret[id] = bt } } ```

Inside that helper, `CheckPublishAuthCookie`, `GetPath…