Kernel: Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

SiYuan versions before 3.7.4 fail to enforce publish-access filtering on the getBlockAttrs and batchGetBlockAttrs API endpoints. This vulnerability (CWE-862) allows unauthenticated attackers to send POST requests with block IDs to retrieve sensitive block attributes including names, aliases, memos, and custom fields from documents that should be protected. The issue affects versions up to and including 3.7.2. The CVSS 3.1 score is 5.8 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact. This advisory is a duplicate of GHSA-qvq9-hq6p-v378 and is maintained only for external reference. No known exploits are reported in the wild.

An attacker can access sensitive metadata of protected documents without authorization by exploiting missing access control checks on specific API endpoints. This leads to partial confidentiality loss of block attributes but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory GHSA-qvq9-hq6p-v378 for current remediation guidance. Since no patch links are provided here, users should monitor official Siyuan advisories for updates and apply any available fixes promptly.