Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-87810Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

Medium 5.3

In plain English

A medium-severity information exposure in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-g45v-hxvm-wccj) vendor-advisory
VulnCheck Advisory: Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock third-party-advisory