CVE-2026-68586 Details
Description
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).
A content disclosure vulnerability has been identified in SiYuan versions prior to 3.7.3. The issue arises because the getBacklinkDoc and getBackmentionDoc content endpoints do not apply the same publish-access filters as their corresponding list endpoints. This oversight allows a publish-mode reader, including an anonymous reader when publish Basic Auth is disabled, to access the rendered content of publish-forbidden documents by directly calling these endpoints with the document's ID. Additionally, this vulnerability creates a reference-existence oracle, enabling the reader to determine if a forbidden document references a specific block.
Users are advised to update to SiYuan version 3.7.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= v3.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |