{"items":[{"id":"NVI-00013211","kind":"vulnerability","title":"SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4vpg-gwqq-w44c","CVE-2026-74904"],"plain_summary":"GitHub lists this reviewed advisory for github.com/siyuan-note/siyuan/kernel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-93115e352f2bde890527657e8ada7989"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-02T23:05:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-93115e352f2bde890527657e8ada7989"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-93115e352f2bde890527657e8ada7989","url":"https://github.com/advisories/GHSA-4vpg-gwqq-w44c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4vpg-gwqq-w44c","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-93115e352f2bde890527657e8ada7989"],"technology":"github.com/siyuan-note/siyuan/kernel","known_exclusions":[],"conditions_summary":"Same CWE-862 family, found via an automated bulk sweep of every\n`/api/block/*` handler in `kernel/api/block.go` for the presence of any\naccess-check reference (`IsReadOnlyRoleContext`, `checkBlockPublishAccess`,\n`GetPublishAccess`) anywhere in the function body. 17 of 28 candidate\nendpoints have none. Cross-checked against the file's own sibling\nfunctions (`getBlockInfo`, `getBlockDOM`, `getRefIDs`, etc.), which\ncorrectly implement the check, confirming this is a real, uneven gap\nrather than a deliberate design choice for the whole file.\n\n\n### Summary\n17 handlers in `kernel/api/block.go`, all gated only by `model.CheckAuth`\nwith no admin-role requirement, return block content-derived text,\nstructural metadata, or existence information for any block ID supplied,\nwith no access check anywhere in the handler or, for the ones checked in\ndetail, the model functions they call. This is CWE-862 (Missing\nAuthorization), the same class as the companion advisories from this\nreview round, found in a different file via a systematic bulk check\nrather than manual inspection of each function individually.\n\n### Details\nConfirmed via automated extraction of every function body between\n`func NAME(c *","public_affected_ranges":["< 0.0.0-20260804015139-bd067a4fe9b2"]}],"null_published_at":"2026-11-01T07:29:12.929Z","source_updated_at":"2026-10-02T23:05:34.000Z","source_disclosed_at":"2026-10-02T23:05:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}