CVE-2026-87810: Exposure of Sensitive Information to an Unauthorized Actor in siyuan-note siyuan
Affects siyuan-note siyuanSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| siyuan-notesiyuan | Affected
| Fixed in
|
GitHub Actionssiyuan-note/siyuanpkg:github/siyuan-note/siyuanOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in Siyuan Note version 3.8.2. Users should upgrade to version 3.8.2 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary as the issue is addressed by the official update.
Description
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
Impact
An unauthenticated attacker can learn whether specific content exists in private or unpublished documents and determine the number of matching blocks and pages. This exposure of sensitive information could aid further reconnaissance or targeted attacks. There is no indication of direct code execution or data modification from this vulnerability.
Summary
CVE-2026-87810 describes an information disclosure vulnerability in Siyuan Note prior to version 3.8.2. The flaw exists in the POST /api/search/fullTextSearchBlock endpoint, which is intended to filter out private blocks from search results. However, it returns unfiltered match counts, allowing unauthenticated publish-mode readers to submit arbitrary search terms and infer the existence and quantity of matching content in hidden or unpublished documents. This leakage of sensitive information occurs without requiring authentication or privileges.