CVE-2026-72795: Missing Authorization in SiYuan Block DOM Rendering

The open-source personal knowledge-management platform SiYuan provides a publish feature to share notes externally. When running in self-hosted or server mode, external readers can access designated documents in a read-only capacity. The APIs responsible for retrieving block Document Object Models (DOMs), specifically /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed, are exposed to allow rendering of pages containing block transclusions. This mechanism relies on dynamic SQL queries to locate and embedded child block elements.

The vulnerability is classified under CWE-862 (Missing Authorization) and manifests because the application fails to validate publish-access controls on individual child blocks fetched via dynamic queries. When resolving these transcluded structures, the backend retrieves internal blocks based on search patterns without confirming if the requesting user possesses authorization to read the parent document containing those blocks. Consequently, unauthorized users can read protected block content through public documents that embed dynamic queries.

The root cause of CVE-2026-72795 is an inconsistent authorization check within the Go backend rendering engine. Inside the SiYuan block model, a document is parsed into an abstract syntax tree (AST) containing nodes of type NodeBlockQueryEmbed. These nodes represent embedded blocks configured to dynamically query the internal SQLite-like database using SQL criteria. When rendering the page DOM, the engine matches these nodes and executes database queries to merge the matching sub-blocks' DOM representation into the parent page.

Although the system correctly enforces access restrictions on the parent document requested by the user, it did not apply authorization checks recursively on the blocks returned from the sub-query. When a read-only or anonymous session calls the DOM retrieval endpoints, the backend queries the database for target child blocks and merges them directly into the output payload. The server bypasses validation for whether the resolved sub-block resides in a password-protected notebook or a private document.

This missing authorization layer creates a logic flaw where any public document containing a dynamic embed block can act as an oracle. If the embedded SQL query inside the public document matches blocks from private files, the server serializes that restricted content into the DOM response. The vulnerability allows an unauthorized remote attacker to extract arbitrary text from secure, non-published notes.

The core fix for CVE-2026-72795 lies in the introduction of an authorization callback interface to check publish access for embedded blocks. In kernel/api/block.go, the application now explicitly determines whether the request originates from a read-only session and initializes a validator closure:

isReadOnlyRole := model.IsReadOnlyRoleContext(c)
var publishAccess model.PublishAccess
var accessChecker model.EmbedBlockAccessChecker
if isReadOnlyRole {
    publishAccess = model.GetPublishAccess()
    accessChecker = func(blockID string) bool {
        // Verifies if the requested block ID can be accessed by the current publish access level
        return model.CheckBlockIdAccessableByPublishAccessInBox(c, publishAccess, blockID, boxID)
    }
}
dom := model.GetBlockDOMWithEmbedInBoxWithAccessChecker(id, boxID, accessChecker)

The validation logic is propagated down to the rendering code in kernel/model/block.go. Within resolveEmbedContentInBox, the returned database blocks are filtered prior to serialization:

func filterEmbedBlocksByAccess(blocks []*sql.Block, accessChecker EmbedBlockAccessChecker) (ret []*sql.Block) {
    if nil == accessChecker {
        return blocks // If no access checker is active (e.g. admin session), return all
    }
    ret = make([]*sql.Block, 0, len(blocks))
    for _, block := range blocks {
        if nil != block && accessChecker(block.ID) {
            ret = append(ret, block) // Only allow blocks that pass verification
        }
    }
    return
}

The patch ensures that blocks failing the accessChecker validation are discarded prior to DOM construction, successfully mitigating the cross-document data leakage.

To exploit CVE-2026-72795, an attacker must first locate a SiYuan instance with public read-only access enabled. The attacker identifies at least one public document that contains a block embed query (NodeBlockQueryEmbed). This configuration is typical for websites using SiYuan as a public CMS or documentation portal where certain pages aggregate content dynamically.

The attacker can then execute a direct HTTP POST request targeting the /api/block/getBlockDOMWithEmbed endpoint, specifying the ID of the public block. Because authorization checks are not applied to the query results, the returned payload contains the complete rendered DOM of the matching transcluded blocks in its attributes.

POST /api/block/getBlockDOMWithEmbed HTTP/1.1
Host: target-siyuan.local
Content-Type: application/json
 
{
  "id": "20260725000001-public1"
}

In a vulnerable deployment, the response contains data-type="NodeBlockQueryEmbed" with the raw HTML representing the forbidden, restricted, or password-protected content. This allows the attacker to extract arbitrary confidential information matching the query terms without needing any administrative credentials or session tokens.

The impact of CVE-2026-72795 is a severe confidentiality compromise of self-hosted SiYuan knowledge databases. An unauthorized attacker can read block content from any private, password-protected, or hidden notebook on the system if it gets matched by the dynamic block embeds. The flaw has a CVSS v4.0 score of 9.2 (Critical) and a CVSS v3.1 score of 8.6 (High), highlighting the ease of exploitation and the depth of the information exposure.

The vulnerability does not allow modification of notes (Integrity) or service disruption (Availability). However, the leakage of confidential personal data, credentials, and organizational documentation represents a critical failure of the platform's privacy-first security model. This threat is particularly acute for public-facing deployments that aggregate notes via SQL block queries.

The primary remediation for CVE-2026-72795 is upgrading the SiYuan application to version 3.7.4 or later. The patch implements the mandatory authorization callbacks to ensure that public queries do not transclude unauthorized content.

If an immediate upgrade is not feasible, administrators should disable public publishing or restrict network access to the instance. This can be achieved by placing the SiYuan workspace behind an authenticating reverse proxy or VPN. Additionally, removing dynamic block embed queries (NodeBlockQueryEmbed) from public pages prevents the unauthorized database querying behavior.