https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:02:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352751 EUVD-2026-352751 https://cve.radiocsirt.org/vuln/euvd-2026-352751 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72792 <p>SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document&#39;s publish password.</p> <p>SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document&#39;s publish password.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72792 https://cve.radiocsirt.org/vuln/ghsa-mp7r-57w4-5qm3 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72792](https://nvd.nist.gov/vuln/detail/CVE-2026-72792).</p> <p>### Summary</p> <p>`/api/tag/getTag` filters its results for reader roles through `FilterTagsByPublishIgnore`, which checks only the *visible* publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered a document&#39;s publish password receives every tag label used inside it, together with occurrence counts.</p> <p>The project has already treated this exact tier mismatch as a vulnerability on a sibling path: commit `82e9ded42` (&#34;Enforce publish access for graph nodes&#34;) moved the graph endpoint off the visible-only filter and onto a password-aware one. `FilterTagsByPublishIgnore` was not upgraded alongside it.</p> <p>### Details</p> <p>| Item | Detail | |---|---| | Route | `kernel/api/router.go:194` `POST /api/tag/getTag` → `model.CheckAuth` → `getTag` | | Middleware | `CheckAuth` only: no `CheckReadonly`, no `CheckAdminRole` | | Guard | Present but at the wrong tier: visible-only, no password check | | Exposed | Every tag label (`#label#` text) and its occurrence count inside password-protected but visible documents |</p> <p>**The tier mismatch.** For reader roles, `getTag` filters via:</p> <p>```go publishIgnore := GetInvisiblePublishAccess(publishAccess) tags = FilterTagsByPublishIgnore(publishIgnore, tags) ```</p> <p>`FilterTagsByPublishIgnore` counts a label if `CheckPathAccessableByPublishIgnore(span.Box, span.Path, publishIgnore)` holds, then reads…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72792](https://nvd.nist.gov/vuln/detail/CVE-2026-72792).</p> <p>### Summary</p> <p>`/api/tag/getTag` filters its results for reader roles through `FilterTagsByPublishIgnore`, which checks only the *visible* publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered a document&#39;s publish password receives every tag label used inside it, together with occurrence counts.</p> <p>The project has already treated this exact tier mismatch as a vulnerability on a sibling path: commit `82e9ded42` (&#34;Enforce publish access for graph nodes&#34;) moved the graph endpoint off the visible-only filter and onto a password-aware one. `FilterTagsByPublishIgnore` was not upgraded alongside it.</p> <p>### Details</p> <p>| Item | Detail | |---|---| | Route | `kernel/api/router.go:194` `POST /api/tag/getTag` → `model.CheckAuth` → `getTag` | | Middleware | `CheckAuth` only: no `CheckReadonly`, no `CheckAdminRole` | | Guard | Present but at the wrong tier: visible-only, no password check | | Exposed | Every tag label (`#label#` text) and its occurrence count inside password-protected but visible documents |</p> <p>**The tier mismatch.** For reader roles, `getTag` filters via:</p> <p>```go publishIgnore := GetInvisiblePublishAccess(publishAccess) tags = FilterTagsByPublishIgnore(publishIgnore, tags) ```</p> <p>`FilterTagsByPublishIgnore` counts a label if `CheckPathAccessableByPublishIgnore(span.Box, span.Path, publishIgnore)` holds, then reads…</p> https://cve.radiocsirt.org/vuln/ghsa-mp7r-57w4-5qm3