CVE-2026-87810

6.9 mediumEPSS 0.3%

Medium (6.9). EPSS 0.3% chance of exploitation in the next 30 days.

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2026-09-09
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g45v-hxvm-wccj
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-fulltextsearchblock
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g45v-hxvm-wccj

Check your stack JSON