Missing Authorization Checks Expose Private Block Content

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan, a popular note-taking and knowledge management platform, contains a critical authorization bypass affecting 17 API endpoints in its block handling system. The vulnerability exists because these endpoints rely solely on basic authentication without implementing publish-access filtering, allowing unauthenticated users in publish mode to access private block metadata, content references, and structural information. This affects organizations and individuals using SiYuan to manage sensitive information, research data, or proprietary knowledge bases, as attackers can enumerate and extract arbitrary blocks across entire workspaces by iterating through block IDs.

Casky's 283 mapped security skills leverage Claude's extended reasoning to identify the attack patterns behind this vulnerability across both Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would observe detection patterns showing unauthorized API calls to block endpoints lacking proper access controls, detection of block ID enumeration attempts, and anomalous extraction of private metadata from publish-mode contexts. The platform's skill mappings would highlight the authorization bypass mechanism—distinguishing between legitimate basic auth usage and malicious exploitation—and flag the structural weakness where authentication exists but authorization filtering is absent, enabling practitioners to prioritize remediation of these high-risk endpoints before attackers systematically harvest sensitive content.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-74904.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-74904

Casky has 283 skills that investigate the attack patterns behind CVE-2026-74904. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn