CVE

CVE-2026-34453

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

siyuan

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. References: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q https://nvd.nist.gov/vuln/detail/CVE-2026-34453 Remediation: Update to version 3.6.2 or later.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: siyuan

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →