CVE-2026-74904 describes a missing authorization vulnerability in SiYuan note-taking software prior to version 3.7.4. Specifically, 17 API endpoints in kernel/api/block.go, including getRefText, checkBlockExist, and getBlockBreadcrumb, do not enforce sufficient access controls beyond basic authentication (model.CheckAuth). They lack publish-access filtering, which permits anonymous users operating in publish mode to retrieve private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace. This results in unauthorized information disclosure.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access private block content and metadata within the SiYuan workspace. This leads to high-impact information disclosure, exposing potentially sensitive or confidential data to unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and avoid enabling publish mode for sensitive workspaces to mitigate unauthorized data disclosure.