THREAT OPS › Threat News › [GHSA] GHSA-67x2-mq63-v9vm (medium) — SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
[GHSA] GHSA-67x2-mq63-v9vm (medium) — SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
GHSA-67x2-mq63-v9vm Severity: medium CVE: CVE-2026-72805
SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
**CVE:** This vulnerability corresponds to CVE-2026-72805.
### Summary
Three block endpoints return document content snippets and
Indicators of compromise
- CVE-2026-72805cve
- http://127.0.0.1:6808/api/block/getBlockInfourl
- http://127.0.0.1:6808/api/block/getBlockBreadcrumburl
- http://127.0.0.1:6808/api/block/getRefTexturl
- http://127.0.0.1:6808/api/block/getBlockTreeInfosurl
Original source: https://github.com/advisories/GHSA-67x2-mq63-v9vm