SiYuan kernel versions up to 3.7.2 have a vulnerability where the getBlockAttrs and batchGetBlockAttrs endpoints do not enforce publish-access checks. This allows attackers to retrieve block attributes such as names, aliases, memos, and custom fields from protected documents without authorization. The advisory is a duplicate and references GHSA-qvq9-hq6p-v378. No patch links are provided in this data.