CVE-2026-87809 is an authorization bypass vulnerability affecting Siyuan Note prior to version 3.8.2. The application fails to enforce publish-access filtering on embedded blocks before rendering content in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. As a result, attackers who have reader-level access can access the fully rendered content of embedded blocks that are intended to be private, hidden, or publish-disabled by leveraging public documents containing embed queries that select those blocks.

An attacker with reader privileges can bypass intended access controls to view sensitive content within private, hidden, or publish-disabled embedded blocks. This exposure could lead to unauthorized disclosure of confidential information. There is no indication of privilege escalation or remote code execution. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade Siyuan Note to version 3.8.2 or later once a fix is officially released. Until then, restrict reader access to trusted users and avoid embedding sensitive blocks in public documents.