CVE-2026-34453: SiYuan Auth Bypass Vulnerability

CVE-2026-34453 Overview

CVE-2026-34453 is an authorization bypass vulnerability affecting SiYuan, a personal knowledge management system. Prior to version 3.6.2, the publish service improperly exposes bookmarked blocks from password-protected documents to unauthenticated visitors. This flaw allows attackers to retrieve sensitive content from protected documents without providing the required password.

Critical Impact

Unauthenticated attackers can access password-protected document content through the publish service, potentially exposing confidential notes, credentials, or other sensitive information stored in SiYuan knowledge bases.

Affected Products

• SiYuan versions prior to 3.6.2

Discovery Timeline

• 2026-03-31 - CVE-2026-34453 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34453

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization). The core issue lies in how the publish service handles authorization checks for bookmarked content in read-only/publish mode.

When the /api/bookmark/getBookmark endpoint processes requests, it calls the FilterBlocksByPublishAccess(nil, ...) function to filter bookmark results. The function is designed to verify whether the requesting user has appropriate access to password-protected documents. However, a critical flaw exists in the implementation: when the function receives a nil context parameter, it incorrectly interprets this as an authorized request rather than an unauthenticated one.

This misinterpretation causes the password verification check to be completely bypassed, allowing the function to return bookmarked blocks from documents that were configured as "Protected" with password requirements. The vulnerability is exploitable as long as at least one block within the protected document has been bookmarked by the document owner.

Root Cause

The root cause is improper null handling in the authorization logic. The FilterBlocksByPublishAccess function fails to properly distinguish between an authenticated context and a nil context. Instead of treating a nil context as unauthorized (which would be the secure default), the function assumes authorization, effectively granting unrestricted access to protected content.

This represents a violation of the security principle of "fail-safe defaults" where the absence of explicit authorization should result in denial of access, not a grant.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a SiYuan instance with publish/read-only mode enabled
2. Sending requests to the /api/bookmark/getBookmark endpoint
3. Receiving bookmarked content from password-protected documents without providing credentials

The attack is particularly dangerous because it targets a feature (bookmarks) that users may not realize could expose their protected content. Users who bookmark important information within password-protected documents would be most at risk.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory GHSA-c77m-r996-jr3q and the related issue discussion.

Detection Methods for CVE-2026-34453

Indicators of Compromise

• Unusual or unexpected requests to /api/bookmark/getBookmark endpoint from external IP addresses
• Access logs showing bookmark API calls without corresponding authentication tokens
• Pattern of repeated API requests targeting bookmark functionality from single sources
• Evidence of data exfiltration attempts through the publish service

Detection Strategies

• Monitor web server access logs for requests to /api/bookmark/getBookmark without valid session cookies or authentication headers
• Implement anomaly detection for unusual spikes in bookmark API requests
• Configure alerts for access to the bookmark endpoint from IP addresses outside expected geographic regions
• Review application logs for null context warnings in authorization-related functions

Monitoring Recommendations

• Enable detailed logging for all API endpoints in SiYuan, particularly those related to bookmarks and document access
• Set up real-time alerting for authentication bypass attempts
• Implement rate limiting on the bookmark API endpoint to slow potential data exfiltration
• Regularly audit which documents have bookmarked blocks and assess exposure risk

How to Mitigate CVE-2026-34453

Immediate Actions Required

• Upgrade SiYuan to version 3.6.2 or later immediately
• Audit any password-protected documents that contain bookmarked blocks for potential unauthorized access
• Review access logs for signs of exploitation prior to patching
• Consider temporarily disabling the publish service if upgrade cannot be performed immediately

Patch Information

The vulnerability has been addressed in SiYuan version 3.6.2. The patch corrects the authorization logic in the FilterBlocksByPublishAccess function to properly handle nil context parameters, ensuring that unauthenticated requests are correctly denied access to protected content.

Users should upgrade to version 3.6.2 or later by downloading from the official GitHub release page.

Workarounds

• Disable the publish/read-only service until the patch can be applied
• Remove bookmarks from any password-protected documents containing sensitive information
• Implement network-level access controls to restrict who can reach the SiYuan publish service
• Use a reverse proxy with additional authentication in front of the SiYuan service