CVE-2026-73606: Authorization Bypass and Information Disclosure in SiYuan /api/block/getRefIDs Endpoint

SiYuan is a local-first personal knowledge management platform designed to orchestrate complex personal databases, document hierarchies, and relational links between data blocks. To facilitate cooperation and knowledge dissemination, the platform incorporates a publish mode that allows self-hosters to share selected notebooks with unauthenticated users, or protect them with granular access levels.

The attack surface of this architecture relies on how the application handles reference queries on shared content. The /api/block/getRefIDs endpoint resolves the bidirectional references between blocks in published notebooks, allowing unauthenticated readers to traverse link networks smoothly.

However, a critical authorization bypass exists because the endpoint fails to properly validate access permissions for password-protected documents. While structural filters successfully screen out documents residing in hidden or completely forbidden notebooks, the application lets unauthenticated users retrieve reference mappings from password-protected documents without entering the associated password.

The vulnerability stems from an inconsistency in how authentication checks are integrated across different layers of the Go-based application kernel. Within kernel/api/router.go, the route for /api/block/getRefIDs is configured to map to the getRefIDs handler. While this route is wrapped with the standard model.CheckAuth middleware, this configuration is insufficient during public publish mode where read-only access is permitted for unauthenticated external clients.

Inside the handler located in kernel/api/block.go, the application retrieves block reference definitions and attempts to sanitize them based on the active user's permissions. The processing logic forwards the query down to FilterRefDefsByPublishIgnore in kernel/model/publish_access.go, which ultimately invokes FilterBlockTreesByPublishIgnore to evaluate permission states.

The structural defect is situated in this validation step. The function relies on CheckPathAccessableByPublishIgnore to filter block trees, but this utility only checks coarse-grained notebook visibility structures (i.e., whether the notebook is configured as hidden or disabled). Because CheckPathAccessableByPublishIgnore has no access to the routing context (*gin.Context), it cannot check the PublishAuthCookie or verify whether the unauthenticated visitor has entered the password required by the document's authorization rules.

Analyzing the vulnerable code path exposes the missing validation layer in the filtering function. The vulnerable implementation in kernel/model/publish_access.go iterates over block trees and directly passes the paths to the structural checker, completely ignoring session or cookie states:

// Vulnerable logic lacking context and password verification
func FilterBlockTreesByPublishIgnore(bts map[string]*treenode.BlockTree, publishIgnore []string) map[string]*treenode.BlockTree {
    ret := make(map[string]*treenode.BlockTree)
    for id, bt := range bts {
        if CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) {
            ret[id] = bt
        }
    }
    return ret
}

To understand the flaw's severity, compare this logic with the standard secure path check defined in checkBlockTreeAccessableByPublishAccess. The secure function processes the *gin.Context object, extracts the notebook password state, and verifies whether the current client holds a valid PublishAuthCookie matching that password:

func checkBlockTreeAccessableByPublishAccess(c *gin.Context, publishAccess PublishAccess, bt *treenode.BlockTree) bool {
    if bt == nil || IsEncryptedBoxDeniedByPublishAccess(bt.BoxID) {
        return false
    }
    publishIgnore := filterDisablePublishAccess(publishAccess)
    passwordID, password := GetPathPasswordByPublishAccess(bt.BoxID, bt.Path, publishAccess)
    return CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) &&
           (password == "" || CheckPublishAuthCookie(c, passwordID, password))
}

Because the vulnerable logic failed to incorporate the *gin.Context and the associated authentication cookie validations, the application allowed unauthenticated users to completely bypass the password protection layer on any notebook, leaking structural relational data.

Exploitation of CVE-2026-73606 does not require high user privileges or complicated exploitation chains. An attacker first locates a target SiYuan instance exposed to the network with publish mode enabled and password-protected notebooks configured. The attacker then constructs a direct POST request targeting the vulnerable /api/block/getRefIDs endpoint.

By querying specific block identifiers, the attacker bypasses the password requirement. The endpoint processes the request and responds with a JSON array mapping reference structures. The disclosure is restricted to block-to-block mapping metadata, specifically structured as RefDefs configurations, returning the referencing block identifiers (RefID and DefIDs).

Although this vulnerability does not leak raw markdown body text, obtaining these unique block identifiers exposes the system's structural layout. An attacker can leverage this relational map to perform targeted discovery attacks, infer the existence of sensitive documents, or use the leaked IDs as inputs to exploit other endpoints.

The primary impact of this flaw is unauthorized information disclosure and metadata mapping. While traditional vulnerabilities might focus on remote code execution, leaking relationship structures in an integrated database environment violates the core design principles of a personal knowledge base, where document relationships often contain sensitive conceptual associations.

From a technical perspective, the CVSS score is established at 6.9 under CVSS v4.0. The attack complexity is low, privileges are not required, and no user interaction is required to trigger the leak. However, because the confidentiality impact is restricted to structural metadata rather than the raw body text of the document, the confidentiality vector is categorized as low.

Nevertheless, in large-scale deployments or corporate deployments utilizing publish mode, the leakage of document structures compromises confidentiality controls. Attackers can map out database connections, track organizational changes, or use the retrieved block mappings to plan more sophisticated targeted attacks against the hosting environment.

The recommended resolution is to upgrade all SiYuan installations to version 3.7.4 or later immediately. The vendor addressed the issue by integrating context awareness into the filtering architecture, ensuring that low-level validation libraries receive the active *gin.Context and execute password validation routines correctly.

If upgrading immediately is not an option, administrators can apply immediate mitigation strategies to minimize exposure. The most effective workaround is to disable anonymous publish mode or deactivate publishing altogether. Alternatively, configure network-level defenses such as firewalls, web application firewalls (WAFs), or reverse proxies to block all unauthenticated traffic targeting /api/ endpoints.

Administrators should also establish detection mechanisms in their logging infrastructure. Look for repetitive unauthenticated requests targeting /api/block/getRefIDs or investigate patterns of unauthenticated clients scanning multiple block IDs in succession, which is a key indicator of database relationship mapping attempts.