CVE-2026-87810 Details
Description
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
An information disclosure vulnerability exists in Siyuan versions prior to 3.8.2, specifically within the POST /api/search/fullTextSearchBlock endpoint. This endpoint is supposed to filter out private blocks from search results but instead returns unfiltered match counts. Unauthenticated users with publish-mode access can exploit this by sending arbitrary search terms to determine if matching content exists in hidden or unpublished documents. The vulnerability allows these users to ascertain the number of matching blocks and pages, effectively leaking information about private documents that should remain confidential.
Users are advised to update to Siyuan version 3.8.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g45v-hxvm-wccj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g45v-hxvm-wccj | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-fulltextsearchblock | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Siyuan | <= v3.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |