CVE-2026-87809

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. An attacker who already holds reader access can open a public document containing an embed query that selects private, hidden, or publish-disabled blocks and receive their full rendered content in the output. The impact is confidentiality-only disclosure of content that publish-access controls were supposed to keep restricted; there is no integrity or availability impact. Only deployments running affected versions that publish public documents containing embed blocks referencing restricted content are affected. No public proof of concept, in-the-wild exploitation, or KEV listing is known, and the flaw is fixed in v3.8.2.

What to do: Upgrade Siyuan to v3.8.2 or later. Until patched, audit published/public documents for embed blocks that reference private, hidden, or publish-disabled content and remove or republish those embeds, and review which accounts hold reader access. Defenders can also confirm whether /api/export/preview and /api/lute/copyStdMarkdown are reachable by untrusted or low-privilege clients and monitor responses for content from restricted blocks.