Why does GHSA-3rfw-7fxw-6jxm have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-3rfw-7fxw-6jxm?

GHSA-3rfw-7fxw-6jxm has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3rfw-7fxw-6jxm?

GHSA-3rfw-7fxw-6jxm affects 1 product, including: go/github.com/siyuan-note/siyuan/kernel:\u003c 3.7.3.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 3, 2026

GHSA-3rfw-7fxw-6jxmMediumCVSS 5.8Disclosed before NVD

Duplicate Advisory: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

September 3, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pm3w-vxp9-ccwc. This link is maintained to preserve external references.

Original Description

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as excluded from publishing.

🎯 Affected products1

go/github.com/siyuan-note/siyuan/kernel:< 3.7.3

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)