CVE-2026-72805

The three endpoints in this CVE share a critical authorization flaw: they verify whether a document is published but never independently confirm that password-based access controls have been satisfied. These are semantically different security boundaries that require separate enforcement—a password-protected document IS published, just gated behind an additional credential. Treating password protection as a superset of publication status is an architectural failure, not merely an implementation oversight. The concrete risk is that block IDs function as an oracle. An attacker who obtains a protected document's block ID—through comments, cross-references, or shared links—can query these endpoints to retrieve structural metadata without authenticating. The exposure of 'ancestor block content snippets' is particularly significant: it means surrounding structural context may be readable even when the protected document itself is inaccessible. In a hierarchical note-taking system, document organization itself is sensitive—exposing that 'a document about X exists under the client folder containing Y' reveals an inference graph that may be more damaging than any single document's content. The CVSS 5.8 score is misleading because it treats individual document exposure as the unit of analysis. The actual blast radius is the workspace's conceptual topology: the hierarchical structure, cross-references, and organizational relationships that users treat as implicitly private. Block IDs leak through routine SiYuan features like comments and reference links, making exploitation less 'targeted' and more 'opportunistic' than the EPSS 0.00237 suggests. When evaluating the patch, ask two questions: first, does it add explicit password checks to each endpoint, or does it simply strip publication metadata from responses? Second, if password checks were added, are they isolated to these three endpoints or part of a generalized authorization layer? If the fix onlyhardcodes checks into these specific functions without refactoring the underlying model, expect similar bugs to surface when new gating dimensions (biometric auth, temporal windows, org-scoped sharing) are introduced. The codebase needs an authorization model where 'gating' is decomposed into orthogonal policies rather than collapsed into a single boolean gate.

Reviewed through automated stages and approved by a human before publication.