CVE-2026-68587
Received Received - Intake

SiYuan Information Disclosure via Unauthorized DOM Access

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68587
EUVD
EUVD-2026-52275

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.7.3 have an information disclosure vulnerability in specific endpoints that return rendered block DOM without proper access checks. This allows anonymous readers or users with publish RoleReader tokens to access full rendered content of documents that should be restricted due to publish restrictions.

Detection Guidance

This vulnerability can be detected by checking if SiYuan versions before v3.7.3 are running and if the affected endpoints (getHeadingDeleteTransaction, getHeadingLevelTransaction, getHeadingInsertTransaction) are accessible without proper authorization. Monitor network traffic for requests to these endpoints with heading block IDs and verify if they return content from restricted documents.

Impact Analysis

This vulnerability could allow unauthorized users to read sensitive or confidential document content that was intended to be restricted. It compromises data confidentiality by exposing restricted information to unintended parties.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive information. Unauthorized disclosure of restricted documents could lead to legal penalties and reputational damage.

Mitigation Strategies

Upgrade SiYuan to version v3.7.3 or later to address the information disclosure vulnerability in heading-related endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart