DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-68586: CVE-2026-68586: Missing Authorization in SiYuan Backlink Content Endpoints Allows Information Disclosure

#security #cve #cybersecurity

CVE-2026-68586: Missing Authorization in SiYuan Backlink Content Endpoints Allows Information Disclosure

Vulnerability ID: CVE-2026-68586
CVSS Score: 9.2
Published: 2026-09-03

SiYuan is a privacy-first personal knowledge management system. In versions prior to v3.7.3, the application fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints correctly filter out publish-forbidden documents, the content endpoints, which are only gated by high-level route authorization checks via CheckAuth, do not. Consequently, a user with low-privilege read access, or an anonymous reader when publish Basic Auth is disabled, can directly invoke these endpoints using a known publish-forbidden document's ID to retrieve its rendered DOM content or determine whether it references a specific target block.

TL;DR

An authorization bypass flaw in SiYuan's reference content retrieval API endpoints allows unauthorized readers to fetch the fully rendered DOM of publish-restricted documents using known document identifiers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network (Remote)
  • CVSS v4.0 Score: 9.2 (Critical)
  • CVSS v3.1 Score: 8.6 (High)
  • Exploit Status: Proof-of-Concept Available
  • CISA KEV Status: Not Listed
  • Remediation Status: Patched in v3.7.3

Affected Systems

  • SiYuan Personal Knowledge Management System
  • SiYuan: < 3.7.3 (Fixed in: 3.7.3)

Code Analysis

Commit: f45749a

Check publish access for backlink content retrieval endpoints

Mitigation Strategies

  • Upgrade SiYuan to version 3.7.3 or higher.
  • Enable Publish Basic Authentication to restrict access to authorized readers only.
  • Disable the web publishing feature entirely if public note access is not required.
  • Deploy reverse proxy rules or WAF policies to monitor and filter traffic to the affected API endpoints.

Remediation Steps:

  1. Identify all running instances of SiYuan in the environment.
  2. Verify the currently installed version using the system settings or by querying the version metadata.
  3. If the version is prior to 3.7.3, download the latest release from the official repository or update the Docker container image.
  4. Apply the update and restart the service.
  5. Configure basic authentication under the publish settings if public note hosting must remain active.
  6. Verify remediation by attempting to query the /api/ref/getBacklinkDoc endpoint as an unauthenticated reader.

References

Read the full report for CVE-2026-68586 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)