This vulnerability exposes a permission boundary failure between SiYuan's UI layer and its API layer. When users mark documents as "publish-forbidden" through the UI, that restriction only applies to the publishing pipeline — it was never propagated to the getBlockInfo API endpoint, which returns the document's metadata (title, notebook name, path, root ID, and icon) to any caller with a RoleReader token or no token at all. An attacker who knows a block ID can query this endpoint and retrieve structural intelligence about documents explicitly meant to be hidden from publication.
The core issue is architectural: SiYuan's API appears to treat document metadata as implicitly public, assuming only the web UI consumes it. As third-party integrations, mobile clients, and automation tools extend beyond the intended interface, this assumption breaks. The 'publish-forbidden' feature was designed as a content-rendering flag for the export pipeline, not as a data-layer access control — the vulnerability emerges when someone queries the API directly.
Check your SiYuan deployment for any endpoint returning block or document metadata under RoleReader scope without explicit authorization checks. Audit for similar patterns where UI-level permissions exist but API-level enforcement does not. The fix likely involves adding authorization gates to getBlockInfo and auditing other endpoints that return structural metadata (notebook, path, root IDs) under the same token scope. Treat any endpoint returning document metadata as a potential information disclosure vector until proven otherwise — the token design may conflate 'can read published content' with 'can query any block ID's metadata,' which is a systemic risk beyond this single CVE.