Kernel: Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

SiYuan versions before v3.7.4 fail to enforce publish-access checks on the getBlockBreadcrumb, getRefText, and getBlockTreeInfos API endpoints. This allows unauthorized users, including anonymous readers or users with publish RoleReader accounts, to retrieve content and metadata from documents that are protected, forbidden, or password-protected. The exposed information includes document titles, ancestor block content snippets, reference text, and path metadata by supplying block IDs. The vulnerability is categorized under CWE-862 (Missing Authorization). This advisory is a duplicate and has been withdrawn, with GHSA-67x2-mq63-v9vm as the canonical reference.

Unauthorized disclosure of protected document content and metadata can occur without authentication or with minimal privileges. Confidential information in documents intended to be restricted or password-protected may be exposed to anonymous or low-privilege users. There is no indication of integrity or availability impact. The CVSS score is 5.8 (medium severity), reflecting the confidentiality impact without integrity or availability effects.

Patch status is not yet confirmed — check the vendor advisory GHSA-67x2-mq63-v9vm for current remediation guidance. Users of SiYuan should upgrade to version v3.7.4 or later once available to ensure publish-access checks are enforced on the affected endpoints. Until patched, restrict access to the affected API endpoints or implement additional access controls to prevent unauthorized information disclosure.