SiYuan versions older than 3.7.4 expose sensitive document data when callers access the getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints. Because the application does not enforce publish‑access checks on these RPC calls, an attacker can supply a block ID and receive the title of the parent document, snippets of ancestor block content, reference text, and path metadata. This leakage applies to both publish‑forbidden and password‑protected documents, thereby compromising confidentiality of protected content. The weakness is a missing authorization flaw (CWE‑862).

The vulnerability affects users of the Siyuan Note application. All releases of Siyuan before version 3.7.4 are impacted. No specific minor release numbers are listed, so any deployment of the software predating that official release is potentially vulnerable.

The CVSS base score is 6.9, indicating a moderate severity. EPSS is not available, so the exact likelihood of exploitation is unknown, but the lack of direct authentication checks makes the attack path straightforward via the documented HTTP endpoints. The vulnerability is not listed in the CISA KEV catalog, yet the nature of the exposure encourages immediate attention. An attacker with network access to the machine hosting the API could craft a request with a valid block ID and retrieve protected metadata. In the absence of additional security controls, the impact could scale up to full disclosure of document structures across an organization.