CVE-2026-93921: SiYuan Auth Bypass Vulnerability

CVE-2026-93921 Overview

CVE-2026-93921 affects SiYuan, a personal knowledge management application, in versions through 3.8.4. The vulnerability allows read-only token holders to bypass publish access controls on the getDynamicIcon endpoint. Attackers can invoke the endpoint with type=8 and crafted content to enumerate document metadata via template injection. Exposed data includes block titles, names, aliases, and the hierarchical paths of restricted documents. The flaw is classified as Missing Authorization [CWE-862] and stems from the endpoint failing to validate publish permissions before rendering template content.

Critical Impact
Authenticated users with read-only tokens can extract metadata from restricted documents in SiYuan installations through version 3.8.4, exposing confidential document structures and naming conventions.

Affected Products

SiYuan versions through 3.8.4
SiYuan kernel API getDynamicIcon endpoint
SiYuan template rendering model

Discovery Timeline

2026-09-19 - CVE-2026-93921 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93921

Vulnerability Analysis

SiYuan exposes a getDynamicIcon handler in kernel/api/icon.go that generates icons for user interface elements. The endpoint accepts a type parameter and associated content. When type=8 is supplied, the handler passes the request content to the template rendering pipeline defined in kernel/model/template.go. That pipeline resolves block references and returns rendered output derived from document metadata.

The router configuration in kernel/api/router.go registers the endpoint without requiring publish-level authorization. Any caller presenting a valid read-only token can invoke the handler. Read-only tokens are intended to grant view access only to explicitly published content, so exposing restricted documents through this path breaks the intended access model.

This is a broken access control issue affecting confidentiality only. Data integrity and availability are not affected. Full technical details are available in the GitHub Security Advisory GHSA-whcx-xxqh-c838 and the VulnCheck Advisory on SiYuan.

Root Cause

The root cause is a missing authorization check on the getDynamicIcon route. The handler at icon.go lines 546-549 invokes template resolution logic without verifying that the caller has publish permissions on the referenced blocks. Read-only tokens inherit access to this endpoint through the router definition at router.go line 51.

Attack Vector

An attacker with a valid read-only API token sends an HTTP request to the getDynamicIcon endpoint. The request specifies type=8 and includes template content that references block identifiers or path expressions for restricted documents. The server processes the template and returns rendered metadata including titles, aliases, names, and hierarchical paths. Reference the template model source for the resolution logic that discloses this information.

Detection Methods for CVE-2026-93921

Indicators of Compromise

HTTP requests to /api/icon/getDynamicIcon containing type=8 in the request body
Requests originating from clients authenticated with read-only tokens that reference block IDs outside the published document set
Unusually high volume of getDynamicIcon calls from a single token holder within a short time window

Detection Strategies

Inspect SiYuan kernel access logs for POST requests to the dynamic icon endpoint and correlate the type parameter values against expected client behavior
Baseline normal getDynamicIcon usage per token and alert on statistical deviations that suggest enumeration
Deploy a reverse proxy in front of SiYuan to log full request bodies for the icon API and enable retroactive analysis

Monitoring Recommendations

Forward SiYuan kernel logs to a centralized logging platform and retain them for at least 90 days
Alert on repeated requests to getDynamicIcon that reference distinct block IDs, which indicates metadata enumeration
Track token issuance and revocation events so that compromised or overly permissive tokens can be identified quickly

How to Mitigate CVE-2026-93921

Immediate Actions Required

Upgrade SiYuan to a version later than 3.8.4 that includes the fix referenced in GHSA-whcx-xxqh-c838
Rotate all existing API tokens, particularly read-only tokens issued to third parties or public users
Audit access logs for prior invocations of getDynamicIcon with type=8 to identify potential data exposure

Patch Information

Refer to the upstream project at the SiYuan GitHub repository for the current release that resolves the missing authorization check. The security advisory GHSA-whcx-xxqh-c838 documents the fixed version and vendor guidance.

Workarounds

Restrict network access to the SiYuan kernel API so that only trusted clients can reach the getDynamicIcon endpoint
Disable issuance of read-only tokens until the instance is upgraded, or scope tokens to a limited network segment
Block requests containing type=8 to /api/icon/getDynamicIcon at an upstream reverse proxy or web application firewall

bash

# Example NGINX rule to block the vulnerable request pattern
location /api/icon/getDynamicIcon {
    if ($request_body ~* "\"type\"\s*:\s*8") {
        return 403;
    }
    proxy_pass http://siyuan_backend;
}