{"items":[{"id":"NVI-00014105","kind":"vulnerability","title":"SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h6w7-xxcf-w2mq","CVE-2026-72795"],"plain_summary":"GitHub lists this reviewed advisory for github.com/siyuan-note/siyuan/kernel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4720da0ef7f2becc1a5a9d624ee3737a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T21:13:14.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4720da0ef7f2becc1a5a9d624ee3737a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4720da0ef7f2becc1a5a9d624ee3737a","url":"https://github.com/advisories/GHSA-h6w7-xxcf-w2mq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h6w7-xxcf-w2mq","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4720da0ef7f2becc1a5a9d624ee3737a"],"technology":"github.com/siyuan-note/siyuan/kernel","known_exclusions":[],"conditions_summary":"**CVE:** This vulnerability corresponds to CVE-2026-72795.\n\n### Summary\n\n`/api/block/getBlockDOMWithEmbed` and `/api/block/getBlockDOMsWithEmbed` gate only the *requested* block against publish access. The blocks pulled in by that block's embed (transclusion) query are inlined into the returned DOM with no publish-access check at all, so a reader who requests a legitimately-published block containing an embed query receives the content of every block that query matched including blocks in hidden, forbidden and password-protected documents.\n\nThe dedicated embed endpoint `getEmbedBlock` filters these same results for reader roles. The DOM-with-embed path does not.\n\n### Details\n\n| Item | Detail |\n|---|---|\n| Routes | `kernel/api/router.go:226` `POST /api/block/getBlockDOMWithEmbed` → `model.CheckAuth` → `getBlockDOMWithEmbed`; `:227` `POST /api/block/getBlockDOMsWithEmbed` → `model.CheckAuth` → `getBlockDOMsWithEmbed` |\n| Middleware | `CheckAuth` only — no `CheckReadonly`, no `CheckAdminRole` → reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is `false` |\n| Guard present | Top-level requested blo","public_affected_ranges":["< 0.0.0-20260725125659-1ca1c3c9d94b"]}],"null_published_at":"2026-11-02T10:00:37.207Z","source_updated_at":"2026-09-04T21:13:14.000Z","source_disclosed_at":"2026-09-04T21:13:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}