CVE-2026-87810

Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

View on CVE.org
Published Sep 9, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.

Analysis

AI-generated

Technical impact

The vulnerability in Siyuan before version 3.8.2 allows unauthenticated publish-mode readers to learn whether certain content exists in hidden or unpublished documents by using the POST /api/search/fullTextSearchBlock endpoint. Although the endpoint filters private blocks from returned results, it still exposes the exact number of matching blocks and pages. This enables the attacker to infer the presence and quantity of confidential material.

Affected Systems

The Siyuan note application, distributed by Siyuan Note (vendor siyuan-note:siyuan), is affected in all releases prior to version 3.8.2. Users running any of those earlier builds are vulnerable.

Risk and Exploitability

The CVSS score of 6.9 identifies the flaw as medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation to date. The attack vector requires only unauthenticated access to the publish‑mode web application and the ability to send a POST request to the fullTextSearchBlock endpoint, allowing an adversary to discover the existence and count of hidden content without further privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Siyuan to version 3.8.2 or later to eliminate the bug.
  • If an immediate upgrade is not feasible, deny unauthenticated publish‑mode readers access to the POST /api/search/fullTextSearchBlock endpoint by adjusting web‑server or application access controls.
  • As a temporary safeguard, disable or restrict search functionality for unauthenticated users until the patch is applied.

Generated by OpenCVE AI on September 9, 2026 at 12:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Vendors & Products Siyuan
Siyuan siyuan
Type Values Removed Values Added
Description Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
Title Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
First Time appeared B3log
B3log siyuan
Weaknesses CWE-200
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Sep 14, 2026, 1:06 PM
Reserved
Sep 9, 2026, 10:30 AM

View source JSON

Updated
Sep 14, 2026, 1:06 PM

JSON

Status
Deferred
Published
Sep 9, 2026, 12:17 PM
Modified
Sep 14, 2026, 1:19 PM

View source JSON

No data.

Updated
Sep 13, 2026, 7:45 PM

JSON