https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:39:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352758 EUVD-2026-352758 https://cve.radiocsirt.org/vuln/euvd-2026-352758 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72803 <p>SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.</p> <p>SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72803 https://cve.radiocsirt.org/vuln/ghsa-qvq9-hq6p-v378 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72803](https://nvd.nist.gov/vuln/detail/CVE-2026-72803).</p> <p>### Summary</p> <p>`POST /api/attr/getBlockAttrs` and `POST /api/attr/batchGetBlockAttrs` return a block&#39;s full attribute set (IAL) with no publish-access check. Both are `CheckAuth`-only, so they are reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. An anonymous reader supplying a block ID receives the block&#39;s name, alias, memo, bookmark, tags, and every `custom-*` attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.</p> <p>### Details</p> <p>Neither handler applies a filter:</p> <p>```go // /api/attr/getBlockAttrs (router line 301) ret.Data = sql.GetBlockAttrs(id)</p> <p>// /api/attr/batchGetBlockAttrs (router line 302) ret.Data = sql.BatchGetBlockAttrs(idList) ```</p> <p>`sql.GetBlockAttrs` is a direct database read returning the block&#39;s entire IAL: `name`, `alias`, `memo`, `bookmark`, `tags`, and any `custom-*` key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.</p> <p>`batchGetBlockAttrs` takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.</p> <p>**Guarded-sibling asymmetry.** The sibling…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72803](https://nvd.nist.gov/vuln/detail/CVE-2026-72803).</p> <p>### Summary</p> <p>`POST /api/attr/getBlockAttrs` and `POST /api/attr/batchGetBlockAttrs` return a block&#39;s full attribute set (IAL) with no publish-access check. Both are `CheckAuth`-only, so they are reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. An anonymous reader supplying a block ID receives the block&#39;s name, alias, memo, bookmark, tags, and every `custom-*` attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.</p> <p>### Details</p> <p>Neither handler applies a filter:</p> <p>```go // /api/attr/getBlockAttrs (router line 301) ret.Data = sql.GetBlockAttrs(id)</p> <p>// /api/attr/batchGetBlockAttrs (router line 302) ret.Data = sql.BatchGetBlockAttrs(idList) ```</p> <p>`sql.GetBlockAttrs` is a direct database read returning the block&#39;s entire IAL: `name`, `alias`, `memo`, `bookmark`, `tags`, and any `custom-*` key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.</p> <p>`batchGetBlockAttrs` takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.</p> <p>**Guarded-sibling asymmetry.** The sibling…</p> https://cve.radiocsirt.org/vuln/ghsa-qvq9-hq6p-v378