CVE-2026-68586
Received Received - Intake

SiYuan Publish-Access Filter Bypass in Content Endpoints

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68586
EUVD
EUVD-2026-52274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.3 has a flaw where publish-access filters are not applied to the getBacklinkDoc and getBackmentionDoc content endpoints. These endpoints return rendered DOM content of documents even if they are marked as publish-forbidden. An attacker can exploit this to retrieve restricted content or check if a document references a specific block.

Impact Analysis

If you use SiYuan in publish mode, an attacker could access sensitive document content that should be restricted. This includes anonymous users if publish Basic Auth is disabled. The attacker can also determine if a document references a specific block, potentially leaking information about document structure or content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If personal or health data is exposed, it may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Upgrade SiYuan to version 3.7.3 or later to address the missing publish-access filters in the content endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart