SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

At a glance

github.com/siyuan-note/siyuan/kernel: Red, act today. SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish …

The flaws

• CVE-2026-73606: SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block (CVSS 5.8 · EPSS 0%)
• CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking (CVSS 10.0 · EPSS 1%)
• CVE-2026-73054: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (CVSS 7.5 · EPSS 1%)
• GHSA-9cqf-hhrq-7v45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route (CVSS 8.6)

The fix

Upgrade github.com/siyuan-note/siyuan/kernel: 3.7.4 · 3.7.3 or later on your release line

Who is exposed: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260721043339-eef10568384e

Where it stands

• Public proof of concept

Connects to

• Same weakness: Incorrect authorisation (CWE-863). 336 other warnings in 30 days