THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-qvq9-hq6p-v378 (medium) — SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

[GHSA] GHSA-qvq9-hq6p-v378 (medium) — SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

highgithub_advisoriesPublished 2026-09-03

GHSA-qvq9-hq6p-v378 Severity: medium CVE: CVE-2026-72803

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

**CVE:** This vulnerability corresponds to CVE-2026-72803.

### Summary

`POST /api/attr/getBlockAttrs` and `POST /api/attr/bat

Indicators of compromise

CVE-2026-72803cve
http://127.0.0.1:6808/api/attr/getBlockAttrsurl
http://127.0.0.1:6808/api/attr/batchGetBlockAttrsurl

Original source: https://github.com/advisories/GHSA-qvq9-hq6p-v378