SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

`/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It runs a scan of the entire `blocks` table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark vocabulary, regardless of whether the bookmarked blocks live in published, hidden, password-protected or forbidden documents.

The adjacent endpoint that returns bookmarks with their blocks does filter, and does so in a way that makes the intended rule explicit: it drops a label entirely when no accessible block carries it.

### Details

**Route.** `kernel/api/router.go:297` on master, `:300` on the development branch:

```go ginServer.Handle("POST", "/api/attr/getBookmarkLabels", model.CheckAuth, getBookmarkLabels) ```

No `CheckAdminRole`, no `CheckReadonly`. Reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`.

**The handler** (`kernel/api/attr.go`) is a single line:

```go ret.Data = model.BookmarkLabels() ```

which reaches `kernel/model/bookmark.go:184` and then `sql.QueryBookmarkLabels()` at `kernel/sql/block_query.go:315`:

```go sqlStmt := "SELECT * FROM blocks WHERE ial LIKE ?" // "%bookmark=%" // collect distinct ialAttr(block.IAL, "bookmark") into a set, sort, return ```

There is no notebook scoping, no path scoping, no publish-access check and no filter function anywhere on the path. Every block in the workspace…