Kernel: Duplicate Advisory: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

SiYuan kernel versions prior to v3.7.3 contain a metadata disclosure vulnerability (CWE-862) in the /api/block/getBlockInfo API endpoint. The endpoint improperly returns metadata including document title, notebook, path, root ID, and icon for documents that administrators have marked as excluded from publishing, without verifying publish access permissions. This allows unauthorized users, including anonymous readers or those with limited publish RoleReader tokens, to retrieve metadata for publish-forbidden documents. The sibling endpoint getDocInfo applies filtering correctly, but getBlockInfo does not. This advisory is a duplicate and has been withdrawn in favor of GHSA-pm3w-vxp9-ccwc.

Unauthorized disclosure of document metadata such as titles and paths for documents that are intended to be restricted from publishing. This could lead to information leakage about document existence and structure, potentially aiding further reconnaissance. There is no impact on document content confidentiality, integrity, or availability reported.

Patch status is not yet confirmed — check the vendor advisory GHSA-pm3w-vxp9-ccwc for current remediation guidance. Since this advisory is withdrawn as a duplicate, refer to the original advisory for patch and mitigation details.