PT-2026-29381 · Siyuan · Siyuan

Ngocnn97 · Publicado 2026-03-31 · Atualizado 2026-04-01 · CVE-2026-34453

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.2

Description The publish service in SiYuan allows unauthenticated visitors to access bookmarked blocks from password-protected documents. This occurs because the /api/bookmark/getBookmark endpoint, when operating in publish/read-only mode, calls the FilterBlocksByPublishAccess(nil, ...) function. Passing nil as the context bypasses the password check, allowing access to content from protected documents if at least one block within those documents is bookmarked. The vulnerable code path resides within the kernel/api/bookmark.go file, specifically in the getBookmark function, and the FilterBlocksByPublishAccess function in kernel/model/publish access.go. The issue stems from treating a nil context as authorized, effectively bypassing the intended password enforcement.

Recommendations Versions prior to 3.6.2: Upgrade to version 3.6.2 or later to resolve this issue.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-34453

GHSA-C77M-R996-JR3Q

Produtos afetados

Siyuan

Referências · 9

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34453.json · Exploit
• https://github.com/siyuan-note/siyuan · Nota
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 · Nota
• https://github.com/siyuan-note/siyuan/issues/17246 · Nota
• https://osv.dev/vulnerability/GHSA-c77m-r996-jr3q · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34453 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039372097835684020 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34453 · Aviso do Fabricante