SiYuan before version 3.7.4 lacks authorization checks on 17 block-related API endpoints in kernel/api/block.go, such as getRefText, checkBlockExist, and getBlockBreadcrumb. The handlers are protected only by basic authentication, meaning that any user with publish-mode access can call these endpoints. An attacker can query arbitrary block IDs and retrieve private text content, structural metadata, and existence information. This leads to information disclosure of potentially sensitive workspace data, reflected in the CWE-862 identifier for missing authorization.

Affected vendors include siyuan-note, with product Siyuan Note. The vulnerability applies to all releases of Siyuan prior to 3.7.4. No other version information is available. The CPE indicates b3log:siyuan.

The CVSS score is 8.7, indicating high severity. EPSS is not available, but the lack of authentication controls makes exploitation straightforward for anyone who can contact the published API endpoints, typically over HTTP(S). The vulnerability does not appear in the CISA KEV catalog. Attackers would do so by sending legitimate API requests to the block endpoints without valid credentials, gaining access to private data due to the permissions model.