https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:42:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352774 EUVD-2026-352774 https://cve.radiocsirt.org/vuln/euvd-2026-352774 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73606 <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.</p> <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73606 https://cve.radiocsirt.org/vuln/ghsa-vg99-7gj7-2fr5 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/block/getRefIDs` filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a document&#39;s publish password learns that the document references a given block.</p> <p>A function ten lines away in the same file does perform the full check, on the same input type.</p> <p>### Details</p> <p>**Route,** identical at `eef105683` (`kernel/api/router.go:235`) and dev `a7ae96ce` (`:245`):</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/block/getRefIDs&#34;, model.CheckAuth, getRefIDs) ```</p> <p>No `CheckReadonly`, no `CheckAdminRole`.</p> <p>**The filter chain.** `getRefIDs` (`kernel/api/block.go:631`) checks `isEncryptedNotebookDeniedForPublish`, calls `model.GetBlockRefsInBox`, then for read-only roles:</p> <p>```go publishIgnore := model.GetInvisiblePublishAccess(publishAccess) refDefs, originalRefBlockIDs = model.FilterRefDefsByPublishIgnore(publishIgnore, refDefs) ```</p> <p>`FilterRefDefsByPublishIgnore` (`kernel/model/publish_access.go:1324`) collects the reference and definition identifiers, resolves their block trees, and delegates the decision to `FilterBlockTreesByPublishIgnore` (`:1314`), whose entire body is:</p> <p>```go for id, bt := range bts { if CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { ret[id] = bt } } ```</p> <p>Inside that helper, `CheckPublishAuthCookie`, `GetPath…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/block/getRefIDs` filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a document&#39;s publish password learns that the document references a given block.</p> <p>A function ten lines away in the same file does perform the full check, on the same input type.</p> <p>### Details</p> <p>**Route,** identical at `eef105683` (`kernel/api/router.go:235`) and dev `a7ae96ce` (`:245`):</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/block/getRefIDs&#34;, model.CheckAuth, getRefIDs) ```</p> <p>No `CheckReadonly`, no `CheckAdminRole`.</p> <p>**The filter chain.** `getRefIDs` (`kernel/api/block.go:631`) checks `isEncryptedNotebookDeniedForPublish`, calls `model.GetBlockRefsInBox`, then for read-only roles:</p> <p>```go publishIgnore := model.GetInvisiblePublishAccess(publishAccess) refDefs, originalRefBlockIDs = model.FilterRefDefsByPublishIgnore(publishIgnore, refDefs) ```</p> <p>`FilterRefDefsByPublishIgnore` (`kernel/model/publish_access.go:1324`) collects the reference and definition identifiers, resolves their block trees, and delegates the decision to `FilterBlockTreesByPublishIgnore` (`:1314`), whose entire body is:</p> <p>```go for id, bt := range bts { if CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { ret[id] = bt } } ```</p> <p>Inside that helper, `CheckPublishAuthCookie`, `GetPath…</p> https://cve.radiocsirt.org/vuln/ghsa-vg99-7gj7-2fr5