This vulnerability involves missing authorization checks in 17 API endpoints in the siyuan-note product's kernel/api/block.go file. These endpoints, including getRefText, getBlockBreadcrumb, checkBlockExist, and others, return sensitive block-level content, metadata, and existence information for any block ID supplied, without verifying user permissions beyond a basic CheckAuth call that does not enforce admin or publish access roles. The lack of access control allows anonymous internet visitors to query and obtain private content and structural information from the entire workspace, not limited to published notebooks. The issue was identified via automated analysis of function bodies for access-check references, confirming an inconsistent and incomplete authorization implementation. The vulnerability affects siyuan versions >=0 and <3.7.4 and has a CVSS 4.0 score of 8.7.

Exploitation of this vulnerability allows unauthenticated attackers to access sensitive content-derived text, structural metadata, and existence information for any block within a siyuan workspace. This can lead to disclosure of private or unpublished content to anonymous internet users. The endpoints act as an existence oracle and content disclosure vector, enabling attackers to probe and confirm private data without legitimate access credentials. This significantly compromises confidentiality of workspace data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected API endpoints to trusted users only, and monitor for unauthorized access attempts. Avoid exposing the siyuan-note service to untrusted networks. Follow vendor updates closely for patches addressing this missing authorization issue.