CVE-2026-68585 describes a missing authorization vulnerability in SiYuan note-taking software versions prior to v3.7.3. The /api/block/getBlockInfo API endpoint returns metadata for documents without verifying if the requester has publish access. As a result, unauthorized users, including anonymous readers or those with limited RoleReader tokens, can obtain metadata of documents administrators intended to keep unpublished. The disclosed metadata includes document title, notebook, path, root ID, and icon. This unauthorized disclosure can lead to information leakage about restricted documents. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). No vendor advisory or patch information is currently available, and the software is not a cloud service.

Unauthorized users can retrieve metadata of documents that are marked as excluded from publishing, potentially exposing sensitive document titles and organizational structure information. This leakage does not grant access to document content but reveals metadata that could aid in reconnaissance or privacy violations. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/block/getBlockInfo endpoint where possible and monitor for unusual access patterns. Avoid exposing publish RoleReader tokens to untrusted users.