SiYuan versions earlier than 3.7.4 expose sensitive block identifiers through the /api/block/getRefIDs endpoint. An unauthenticated request can reveal which blocks a password‑protected document references, allowing a reader to obtain block identifiers without knowing the document password. The flaw is a narrow disclosure of internal identifiers rather than unrestricted document content, but it can aid attackers in mapping the document’s structure or in preparing further attacks. The weakness is classified as CWE‑639, reflecting the lack of authorization checks.

The vulnerability affects the Siyuan Note application, version 3.7.3 and earlier. Users running any pre‑3.7.4 release of the software are susceptible to this information disclosure when the endpoint is accessed by an unauthenticated client.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, so the current likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only network access to the exposed API endpoint and does not demand privileged credentials, so any unauthenticated user can exploit it. Even though the data leaked are only block identifiers, an attacker could use them to facilitate deeper reconnaissance of the document, making the vulnerability non‑negligible for exposed installations.