https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:53:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352928 EUVD-2026-352928 https://cve.radiocsirt.org/vuln/euvd-2026-352928 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73609 <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.</p> <p>SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73609 https://cve.radiocsirt.org/vuln/ghsa-j4ph-9xwf-wcj4 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It runs a scan of the entire `blocks` table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author&#39;s complete bookmark vocabulary, regardless of whether the bookmarked blocks live in published, hidden, password-protected or forbidden documents.</p> <p>The adjacent endpoint that returns bookmarks with their blocks does filter, and does so in a way that makes the intended rule explicit: it drops a label entirely when no accessible block carries it.</p> <p>### Details</p> <p>**Route.** `kernel/api/router.go:297` on master, `:300` on the development branch:</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/attr/getBookmarkLabels&#34;, model.CheckAuth, getBookmarkLabels) ```</p> <p>No `CheckAdminRole`, no `CheckReadonly`. Reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`.</p> <p>**The handler** (`kernel/api/attr.go`) is a single line:</p> <p>```go ret.Data = model.BookmarkLabels() ```</p> <p>which reaches `kernel/model/bookmark.go:184` and then `sql.QueryBookmarkLabels()` at `kernel/sql/block_query.go:315`:</p> <p>```go sqlStmt := &#34;SELECT * FROM blocks WHERE ial LIKE ?&#34; // &#34;%bookmark=%&#34; // collect distinct ialAttr(block.IAL, &#34;bookmark&#34;) into a set, sort, return ```</p> <p>There is no notebook scoping, no path scoping, no publish-access check and no filter function anywhere on the path. Every block in the workspace…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>`/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It runs a scan of the entire `blocks` table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author&#39;s complete bookmark vocabulary, regardless of whether the bookmarked blocks live in published, hidden, password-protected or forbidden documents.</p> <p>The adjacent endpoint that returns bookmarks with their blocks does filter, and does so in a way that makes the intended rule explicit: it drops a label entirely when no accessible block carries it.</p> <p>### Details</p> <p>**Route.** `kernel/api/router.go:297` on master, `:300` on the development branch:</p> <p>```go ginServer.Handle(&#34;POST&#34;, &#34;/api/attr/getBookmarkLabels&#34;, model.CheckAuth, getBookmarkLabels) ```</p> <p>No `CheckAdminRole`, no `CheckReadonly`. Reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`.</p> <p>**The handler** (`kernel/api/attr.go`) is a single line:</p> <p>```go ret.Data = model.BookmarkLabels() ```</p> <p>which reaches `kernel/model/bookmark.go:184` and then `sql.QueryBookmarkLabels()` at `kernel/sql/block_query.go:315`:</p> <p>```go sqlStmt := &#34;SELECT * FROM blocks WHERE ial LIKE ?&#34; // &#34;%bookmark=%&#34; // collect distinct ialAttr(block.IAL, &#34;bookmark&#34;) into a set, sort, return ```</p> <p>There is no notebook scoping, no path scoping, no publish-access check and no filter function anywhere on the path. Every block in the workspace…</p> https://cve.radiocsirt.org/vuln/ghsa-j4ph-9xwf-wcj4