https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:47:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278489 EUVD-2026-278489 https://cve.radiocsirt.org/vuln/euvd-2026-278489 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34453 <p>SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.</p> <p>SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34453 https://cve.radiocsirt.org/vuln/ghsa-c77m-r996-jr3q <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary The publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, `/api/bookmark/getBookmark` filters bookmark results by calling `FilterBlocksByPublishAccess(nil, ...)`. Because the filter treats a `nil` context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as `Protected`. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked.</p> <p>### Details The issue is caused by an authorization bypass in the bookmark API path used by the publish service.</p> <p>In `kernel/api/bookmark.go`, `getBookmark` checks whether the current request is in a read-only role and then filters bookmarks for publish access. However, it passes `nil` as the request context: ```go if model.IsReadOnlyRoleContext(c) { publishAccess := model.GetPublishAccess() tempBookmarks := &amp;model.Bookmarks{} for _, bookmark := range *bookmarks { bookmark.Blocks = model.FilterBlocksByPublishAccess(nil, publishAccess, bookmark.Blocks) ``` In `kernel/model/publish_access.go`, `FilterBlocksByPublishAccess` allows access when `c == nil`: ```go if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) &amp;&amp; (c == nil || password == &#34;&#34; || CheckPublishAuthCookie(c, passwordID, password)) { ret = append(ret, block…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary The publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, `/api/bookmark/getBookmark` filters bookmark results by calling `FilterBlocksByPublishAccess(nil, ...)`. Because the filter treats a `nil` context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as `Protected`. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked.</p> <p>### Details The issue is caused by an authorization bypass in the bookmark API path used by the publish service.</p> <p>In `kernel/api/bookmark.go`, `getBookmark` checks whether the current request is in a read-only role and then filters bookmarks for publish access. However, it passes `nil` as the request context: ```go if model.IsReadOnlyRoleContext(c) { publishAccess := model.GetPublishAccess() tempBookmarks := &amp;model.Bookmarks{} for _, bookmark := range *bookmarks { bookmark.Blocks = model.FilterBlocksByPublishAccess(nil, publishAccess, bookmark.Blocks) ``` In `kernel/model/publish_access.go`, `FilterBlocksByPublishAccess` allows access when `c == nil`: ```go if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) &amp;&amp; (c == nil || password == &#34;&#34; || CheckPublishAuthCookie(c, passwordID, password)) { ret = append(ret, block…</p> https://cve.radiocsirt.org/vuln/ghsa-c77m-r996-jr3q