SiYuan Go Package Vulnerability: Missing Publish-Access Checks
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- Not yet available
An early warning has been issued regarding the SiYuan Go package, which reportedly has missing publish-access checks on three block endpoints. This vulnerability may allow anonymous readers to access content and metadata of password-protected documents when publish authentication is disabled.
What happened
The SiYuan Go package is under investigation for missing publish-access checks on the getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints. This vulnerability appears to disclose content and metadata of protected or forbidden documents. Affected versions include siyuan (go) up to and including 0.0.0-20260313024916-fd6526133bb3. The issue has been flagged with the identifiers CVE-2026-72805 and GHSA-67X2-MQ63-V9VM.
Professional software engineers using the SiYuan Go package should assess their exposure by checking if their implementations disable publish authentication and if they are using an affected version. The vulnerability allows anonymous readers to access sensitive information, which could lead to unauthorized data disclosure.
What to do about it
- Monitor the SiYuan project for patches and updates related to this vulnerability.
- Update the SiYuan package to a fixed version once it is released.
- Ensure that publish authentication is enabled to mitigate the risk of unauthorized access to protected documents.
- Review access controls and permissions for all document endpoints to ensure they are properly secured.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the SiYuan Go package version 0.0.0-20260313024916-fd6526133bb3 or earlier and have publish authentication disabled.
What should I do right now?
Monitor for patches and updates from the SiYuan project. Enable publish authentication to reduce the risk of unauthorized access.
Is there a patched version available?
No official fix has been published yet. Continue to monitor the sources for updates.