---
id: CVE-2026-34453
title: SiYuan is a personal knowledge management system
summary: >-
  SiYuan is a personal knowledge management system. Prior to version 3.6.2, the
  publish service exposes bookmarked blocks from password-protected documents to
  unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark
  f…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: b3log
product: siyuan
affected:
  - siyuan < 3.6.2
patched:
  - siyuan 3.6.2
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34453'
references:
  - url: 'https://github.com/siyuan-note/siyuan/issues/17246'
    label: security-advisories@github.com
  - url: 'https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q
    label: security-advisories@github.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.0145
epssPercentile: 0.72218
ingestedAt: '2026-07-25T21:03:58.084Z'
exploits:
  nuclei:
    - CVE-2026-34453
  checkedAt: '2026-09-25T08:20:55.441Z'
exploitAvailable: true
---

## Overview

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.

## Affected

- `siyuan < 3.6.2`

## Remediation

Upgrade past the affected range:

- `siyuan 3.6.2`