Security Advisory

CVE-2026-68585

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-03 13:20:37

Last updated 2026-08-03 14:17:52

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as excluded from publishing.

← Browse all CVEs View on cve.org ↗