CVE-2026-72803 is a medium-severity (CVSS 5.8) CWE-862 vulnerability in github.com/siyuan-note/siyuan/kernel. O3 Security confirms whether CVE-2026-72803 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-72803.
Real-World Exposure
github.com/siyuan-note/siyuan/kernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
CVE: This vulnerability corresponds to CVE-2026-72803.
Summary
POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set (IAL) with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives the block's name, alias, memo, bookmark, tags, and every custom-* attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.
Details
Neither handler applies a filter:
// /api/attr/getBlockAttrs (router line 301)
ret.Data = sql.GetBlockAttrs(id)
// /api/attr/batchGetBlockAttrs (router line 302)
ret.Data = sql.BatchGetBlockAttrs(idList)
sql.GetBlockAttrs is a direct database read returning the block's entire IAL: name, alias, memo, bookmark, tags, and any custom-* key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata.
batchGetBlockAttrs takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call.
Guarded-sibling asymmetry. The sibling metadata endpoint getBlockInfo calls checkBlockPublishAccess(c, id, ret) before returning; getBlockAttrs and batchGetBlockAttrs call nothing.
Verified at origin/master: both handler bodies contain no publish-access, publish-ignore, or readonly-role check, and both routes are registered CheckAuth without CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. A document is marked publish-forbidden (or password-protected) and contains a block with a memo and a custom attribute set.
Single-block disclosure:
POST http://127.0.0.1:6808/api/attr/getBlockAttrs
{"id":"<BLOCK_ID_IN_PROTECTED_DOC>"}
Returns the block's IAL: name, alias, memo, bookmark, tags, and all custom-* values.
Bulk disclosure:
POST http://127.0.0.1:6808/api/attr/batchGetBlockAttrs
{"ids":["<ID1>","<ID2>","<ID3>"]}
Returns the attribute sets for every supplied ID in one response, with no per-ID authorization.
Control: the sibling getBlockInfo with the same block ID is refused by checkBlockPublishAccess, confirming the boundary is enforced elsewhere and omitted here.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read block attributes belonging to publish-forbidden and password-protected documents, including user-authored memos and arbitrary custom-* values. The batch endpoint turns this into a bulk primitive: given a set of block IDs, an attacker retrieves attributes across the whole workspace in a single request. Confidentiality-only.
Suggested fix
Call checkBlockPublishAccess in getBlockAttrs before returning, matching getBlockInfo. For batchGetBlockAttrs, apply the check per ID and drop unauthorized entries from the response rather than failing the whole batch.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/siyuan-note/siyuan/kernel | all versions | 0.0.0-20260724093256-229fdffd7e4a |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/siyuan-note/siyuan/kernel. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/siyuan-note/siyuan/kernel to 0.0.0-20260724093256-229fdffd7e4a or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-72803 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-72803 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-72803. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-72803 in your dependencies?
O3 detects CVE-2026-72803 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.