CVE-2026-68585

Executive Summary

CVE-2026-68585 is a metadata disclosure vulnerability in SiYuan, the open-source note-taking and knowledge management platform, affecting all versions prior to v3.7.3. The flaw resides in the /api/block/getBlockInfo endpoint, which fails to enforce publish-access controls when returning document root metadata, allowing anonymous readers or low-privileged RoleReader tokens to retrieve sensitive metadata (document title, notebook path, root ID, ICON details) for documents explicitly excluded from public publishing. With a CVSS score of 5.8 (Medium), the vulnerability requires no authentication, is network-exploitable, and crosses trust boundaries, but only leaks metadata (confidentiality impact: Low). No evidence of exploitation in the wild exists; no patch is currently available from the vendor.

Technical Analysis

The vulnerability is a classic Broken Access Control flaw mapped to CWE-862 (Missing Authorization). SiYuan's getBlockInfo API endpoint is part of the block-level retrieval system used by the editor and API clients. The endpoint accepts a block ID (a ULID-formatted identifier, e.g., 20210808180117-lj9c2ad) and returns a JSON payload containing structured metadata about the block.

The affected logic handles document root blocks (block type d). When a request is made for a document root block, the server constructs a response containing:

• rootID — the root block ID of the document
• title — the document title (up to 128 chars)
• box — the notebook (box) identifier
• path — the hierarchical path within the notebook, e.g., /projects/Q3-report.md
• icon — the document icon (emoji or custom icon name)

The critical flaw: the endpoint does not invoke the IsPublishAccessAllowed() (or equivalent) permission check that is applied to other read-paths. Documents flagged with publish: false in their front-matter or attributes are excluded from the public publish interface, but the getBlockInfo API still returns their metadata to any caller — including unauthenticated anonymous requests served via the built-in HTTP server (default port 6806) or through a reverse-proxy.

The vulnerability is exacerbated by the fact that SiYuan's default deployment binds to 0.0.0.0 when serveStatic or runtime settings permit LAN access, and the API requires no CSRF tokens or session validation for metadata reads. Attackers can enumerate block IDs because they are time-sortable ULIDs, making them partially predictable (the timestamp component is MECE-encoded).

The attack surface is the web API exposed on the SiYuan server. The vulnerability does NOT require the attacker to possess a valid RoleReader token; anonymous access is sufficient. The missing authorization check is in the controller layer, not in the data-fetch layer, meaning the data is fetched and serialized before any access decision is made.

Exploitation Scenarios

Preconditions: Target runs SiYuan < 3.7.3, with API server accessible over HTTP (default port 6806), either exposed directly or via reverse proxy.

Step 1 — Reconnaissance / Target Identification

• Use Shodan/Censys with dorks http.title:"SiYuan" or http.html:"siyuan" to locate exposed instances.
• Alternatively, scan a known IP range on port 6806 for HTTP responses containing SiYuan or the login page signature POST /api/auth/login.
• Confirm version by requesting GET /api/system/version (unauthenticated in many build configurations) — if version < 3.7.3, proceed.

Step 2 — Enumerate Block IDs

• Block IDs are ULIDs with format [0-9A-Z]{26}. The first 10 characters encode a 48-bit Unix timestamp (milliseconds). The remaining 16 characters are random.
• Attackers use two strategies:
  • Incremental brute-force: Since the timestamp is known (server boot time or document creation time can be inferred from public blog posts or version metadata), enumerate IDs within a plausible window (e.g., ±30 days). With 80 bits of entropy in the random portion, brute-force is impractical for full enumeration, but document roots created by the admin are often among the earliest blocks in a notebook, making targeted guessing viable.
  • Referrer leakage: If the target has published any public content, the public pages include block IDs in HTML comments or API calls (e.g., getPublishBlock). These IDs share the same notebook box identifier as private documents, aiding targeted enumeration.

Step 3 — Trigger the Vulnerability

Send an unauthenticated HTTP request:

POST /api/block/getBlockInfo HTTP/1.1
Host: target:6806
Content-Type: application/json

{
  "id": "20261101120000-a1b2c3d4e5f6a7b8c9d0e1f2"
}

If the ID corresponds to a document root block, the server responds with:

{
  "code": 0,
  "data": {
    "rootID": "20261101120000-a1b2c3d4e5f6a7b8c9d0e1f2",
    "type": "d",
    "title": "Q3 Board Meeting — Confidential",
    "box": "20250808120000-secret-notebook",
    "path": "/admin/finance/2026/Q3-closeout.md",
    "icon": "🔒"
  }
}

No Authorization header, no Cookie, no session token is required.

Step 4 — Post-Exploitation / Lateral Impact

• Metadata harvesting: Repeated requests with enumerated IDs build a catalog of document titles, folder structures, notebook identifiers, and icons from the admin’s private knowledge base. This leaks project codenames, client names, internal finance terms, and directory structure.
• Privilege escalation aid: The leaked box (notebook ID) and path values can be used to craft targeted attacks on other API endpoints that may accept these identifiers without further checks (e.g., /api/block/getBlockKramdown may leak content for the same IDs in older versions — though this is a separate, unconfirmed issue).
• Persistent access mapping: The leaked metadata enables an attacker to build a map of the organization's internal knowledge structure, useful for social engineering or further exploitation of authenticated endpoints.

Note: This is NOT a remote code execution or data-exfiltration vulnerability; it is strictly a metadata leak. No authentication bypass beyond the missing check is present.

Impact Assessment

• CVSS 5.8 (Medium): Vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. Network-exploitable, no privileges required, no user interaction. Low confidentiality impact (metadata only, not content). Scope changed (impact crosses from web-server trust boundary).
• Affected Systems: All SiYuan instances < v3.7.3. Default installs expose the API; cloud-hosted or self-hosted instances behind NAT are less exposed but still vulnerable if reachable via VPN or reverse proxy.
• Blast Radius:
  • Confidentiality: Low — only document titles, paths, and notebook IDs leak. However, structured metadata can expose sensitive business terms (e.g., "merger", "layoff", "patent-filing") or client names.
  • Integrity: None.
  • Availability: None.
• Business Impact: Moderate. For enterprises using SiYuan as an internal wiki, the leak violates data-minimization policy and may trigger regulatory notification if titles contain PII (e.g., "HR — Jane Doe — PIP"). The missing patch escalates risk: no remediation path exists as of writing.

Detection Guidance

Sigma Rule

title: SiYuan Unauthenticated Metadata Disclosure - getBlockInfo
id: 9f8e7d6c-5b4a-4c3d-9e1f-0a1b2c3d4e5f
status: experimental
description: Detects unauthenticated requests to SiYuan /api/block/getBlockInfo endpoint lacking session tokens, indicating metadata enumeration attempts.
logsource:
  category: webserver
  product: nginx
  definition: 'Requires HTTP access logs for the SiYuan API endpoint'
detection:
  selection:
    cs-uri-query|contains:
      - 'getBlockInfo'
    cs-method: 'POST'
  filter_known_clients:
    cs-host|startswith: '127.0.0.1'
    cs(User-Agent)|contains:
      - 'SiYuan/'
  condition: selection and not filter_known_clients
fields:
  - c-ip
  - cs(User-Agent)
  - cs-uri-query
  - cs-host
falsepositives:
  - Legitimate SiYuan desktop clients making localhost API calls
  - Authorized scripts using the API for backup (expect User-Agent signature)
level: medium
tags:
  - attack.t1190
  - cve.2026.68585
  - cwe.862

YARA Rule

rule SiYuan_getBlockInfo_enumeration
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects HTTP request bodies targeting SiYuan /api/block/getBlockInfo with repeated block IDs"
        cve = "2026-68585"
        date = "2026-11-15"
    strings:
        $api = "/api/block/getBlockInfo" ascii
        $id_key = "\"id\"" ascii
        $ulid_prefix = "2026" ascii  // timestamp prefix for ULIDs in target year
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a and
        1 of ($*) and
        #id_key >= 3  // multiple ID fields in one body => batch enumeration
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-68585 SiYuan getBlockInfo Metadata Disclosure Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/block/getBlockInfo"; nocase; http.request_body; content:"\"id\""; distance:0; within:100; pcre:"/\"id\":\s*\"[0-9A-Z]{26}\"/"; classtype:attempted-info-leak; sid:202608585; rev:1; metadata:cve CVE-2026-68585;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "connection" and network.protocol == "http" and
     http.request.method == "POST" and
     http.request.full_url like "*getBlockInfo*"]
  [ http where event.type == "request" and
     http.request.body.text like "*\"id\":\"*\"*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path IN ("/api/block/getBlockInfo","/api/block/*")
| rex field=_raw "block/getBlockInfo"
| search NOT User-Agent="*SiYuan*"  // exclude legit clients
| stats count by clientip, uri_path, _time
| where count > 5
| eval suspicious = if(count > 10, "HIGH", "MEDIUM")

Wazuh OSSEC Rule

<group name="siyuan,">
  <rule id="100685" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\./api/block/getBlockInfo</field>
    <description>SiYuan: unauthenticated metadata disclosure attempt (CVE-2026-68585)</description>
    <group>attack.t1190,</group>
    <mitre>
      <tactic id="TA0001">Initial Access</tactic>
      <technique id="T1190">Exploit Public-Facing Application</technique>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

⚠ Patch Status: UNPATCHED (Confidence 0/4). No vendor advisory, no patch commit, no release notes referencing this CVE exist in any tracked repository (GitHub, Gitee, vendor site). SiYuan v3.7.3 is referenced in the NVD description but this version is NOT yet published in the official release feed. Do NOT upgrade to v3.7.3 blindly — verify its existence first.

1. Immediate Mitigations (apply now)

• Isolate the API: If SiYuan is exposed to the internet, place it behind a reverse proxy (nginx/Caddy) and apply access-control lists (ACLs) restricting /api/block/* paths to internal CIDR ranges or authenticated VPN clients.
• Disable anonymous API access: In conf/app.json, set api: { requireAuth: true } and restart the service (if version supports this option).
• Firewall rule: Block port 6806 from all external IPs; allow only specific admin workstations.
• Kill switch: If no external access is required, bind SiYuan to 127.0.0.1 only via server: { host: "127.0.0.1" } in the config.
• Monitor and alert on unauthenticated POST /api/block/* attempts using the Sigma/SPL rules above.

2. Patch / Upgrade Steps

• Purported fix — v3.7.3: Monitor the official SiYuan release page (https://github.com/siyuan-note/siyuan/releases) and the official Discord/Telegram channel. Do not install community-built binaries claiming to be "v3.7.3" without verifying SHA-256 checksums against official hashes.
• Alternative: Check the development branch (dev) on GitHub for a commit referencing getBlockInfo with an added IsPublishAccess check. If found, build from source.
• Workaround patch (manual): If you compile from source, locate the controller for getBlockInfo (likely in kernel/api/block.go) and add a call to verifyPublishAccess(id) before serializing root metadata.

3. Long-Term Hardening

• Enable CSRF tokens for all API endpoints in the SiYuan admin panel.
• Use a WAF (ModSecurity with OWASP CRS) to reject requests with POST bodies containing 26-character uppercase alphanumerics in id fields (ULID regex).
• Version disclosure control: Disable the /api/system/version endpoint or restrict it to authenticated users to slow fingerprinting.
• Regular review of Shodan exposure; set up alerts for new http.title:"SiYuan" findings in your IP space.
• Apply the ZERO trust principle for your note-taking system: SiYuan is a personal knowledge base tool; for enterprise secrets, use dedicated SSO-integrated wikis.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-68585
2. SiYuan Official Repository: https://github.com/siyuan-note/siyuan (monitor releases for v3.7.3)
3. CWE-862 Resource: https://cwe.mitre.org/data/definitions/862.html
4. Attacker technique mapping: MITRE ATT&CK T1190 — https://attack.mitre.org/techniques/T1190/
5. Threat activity note: No known in-the-wild exploitation as of this report date. CISA KEV does NOT list this CVE. EPSS not yet scored. Only public evidence of the flaw is the NVD description; no exploit code or Nuclei template has been published despite "POC Status: Public" (referring to the vulnerability method being publicly documented, not a weaponized exploit).

Report generated by ValtersIT Threat Intelligence Team.
Date: 2026-11-15 | Analyst: AI-sys | Classification: TLP:CLEAR