PT-2026-29381 · Siyuan · Siyuan

Ngocnn97 · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34453

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.2

Description The publish service in SiYuan allows unauthenticated visitors to access bookmarked blocks from password-protected documents. This occurs because the /api/bookmark/getBookmark endpoint, when operating in publish/read-only mode, calls the FilterBlocksByPublishAccess(nil, ...) function. Passing nil as the context bypasses the password check, allowing access to content from protected documents if at least one block within those documents is bookmarked. The vulnerable code path resides within the kernel/api/bookmark.go file, specifically in the getBookmark function, and the FilterBlocksByPublishAccess function in kernel/model/publish access.go. The issue stems from treating a nil context as authorized, effectively bypassing the intended password enforcement.

Recommendations Versions prior to 3.6.2: Upgrade to version 3.6.2 or later to resolve this issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-34453

GHSA-C77M-R996-JR3Q

Affected Products

Siyuan

References · 9

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34453.json · Exploit
• https://osv.dev/vulnerability/GHSA-c77m-r996-jr3q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34453 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34453 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 · Note
• https://github.com/siyuan-note/siyuan/issues/17246 · Note
• https://twitter.com/CVEnew/status/2039372097835684020 · Twitter Post