CVE-2026-72812
Received Received - Intake

SiYuan Missing Authorization in API Endpoint

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72812
EUVD
EUVD-2026-58627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.7.4 have a missing authorization flaw in the /api/ref/refreshBacklink endpoint. This allows anonymous users to trigger server-side writes by sending a crafted block ID. The endpoint flushes transaction queues, scans all references, and enqueues database writes without proper checks, bypassing read-only protections.

Detection Guidance

Check SiYuan server logs for repeated POST requests to /api/ref/refreshBacklink with arbitrary block IDs. Monitor for unusual resource usage spikes or transaction queue flushes. Use network traffic inspection tools like tcpdump or Wireshark to detect unauthorized endpoint access.

Impact Analysis

Attackers can exploit this to perform resource amplification attacks, consuming excessive server resources and causing denial-of-service (DoS). They can force reindexing of any document, including those outside their access scope, though no data corruption or injection occurs.

Mitigation Strategies

Upgrade SiYuan to v3.7.4 or later. Implement strict access controls to block unauthenticated requests to /api/ref/refreshBacklink. Add server-side authorization checks like CheckReadonly or CheckAdminRole to enforce read-only settings. Temporarily disable the endpoint if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart