CVE-2026-34453
HighPublic exploitSiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark
Published Mar 31, 2026 · Updated Aug 12, 2026 · Also known as GHSA-c77m-r996-jr3q, GO-2026-5318
Key Facts
Patch immediately- CVE-2026-34453 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Siyuan (B3log), github.com/siyuan-note/siyuan/kernel (go).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 1.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including Siyuan 3.6.2, github.com/siyuan-note/siyuan/kernel 3.6.2.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
1.5%
Higher than 72.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-34453 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...).
Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SiyuanB3log | >= < 3.6.2 | 3.6.2 |
| github.com/siyuan-note/siyuan/kernelgo | See advisory | 3.6.2 |
Patched Releases
Siyuan
3.6.2
github.com/siyuan-note/siyuan/kernel
3.6.2
Timeline
Publicly disclosed
Mar 31, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-863 Incorrect Authorization
References
- advisoryGHSA advisory
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-34453
- articlehttps://github.com/siyuan-note/siyuan/issues/17246
- articlehttps://github.com/siyuan-note/siyuan/releases/tag/v3.6.2
FAQ
Common Questions.
SiYuan is a personal knowledge management system.
Affected: Siyuan (B3log) versions >= < 3.6.2; github.com/siyuan-note/siyuan/kernel (go). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Siyuan 3.6.2, github.com/siyuan-note/siyuan/kernel 3.6.2.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-34453 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo