A broken access control flaw in the /api/block/getBlockInfo endpoint allows an attacker to retrieve metadata such as document title, notebook, path, root ID, and icon for documents that administrators have marked as excluded from publishing. Because the endpoint performs no publish‑access checks, anonymous readers or users with a publish RoleReader token can supply a block ID to expose this sensitive information. This results in the unintentional disclosure of document metadata, potentially revealing the existence and organization of unpublished contents.

The vulnerability affects the Siyuan note application from the vendor siyuan-note, specifically all releases prior to version 3.7.3. Any deployment of these earlier releases that has the /api/block/getBlockInfo endpoint exposed to users without proper access control is susceptible.

The CVSS score of 6.9 indicates a medium severity risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated or lightweight authenticated request to the /api/block/getBlockInfo endpoint, where an attacker supplies a block ID to retrieve metadata. The ability to learn document titles and paths can aid reconnaissance and facilitate further attacks against the system.