DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-68587: CVE-2026-68587: Broken Access Control in SiYuan Note Transaction Endpoints

#security #cve #cybersecurity

CVE-2026-68587: Broken Access Control in SiYuan Note Transaction Endpoints

Vulnerability ID: CVE-2026-68587
CVSS Score: 9.2
Published: 2026-09-03

CVE-2026-68587 is a critical authorization bypass vulnerability in SiYuan, an open-source personal knowledge management workspace. When deployed in publish mode, specific transaction endpoints fail to perform administrative role validation. This omission enables unauthenticated remote readers to retrieve the rendered Document Object Model (DOM) of publish-disabled (private) documents by supplying a target heading block identifier. Upgrading to version v3.7.3 or later resolves this issue by applying appropriate routing middleware constraints.

TL;DR

An unauthenticated remote information disclosure vulnerability exists in SiYuan Note versions prior to v3.7.3. Due to missing authorization checks in the heading transaction endpoints, an attacker can access the rendered content of private documents by targeting their block IDs. The vulnerability has been resolved by enforcing administrative authorization checks on the affected API routes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Vulnerability Type: Missing Authorization
  • CVSS v4.0 Score: 9.2
  • Attack Vector: Network
  • Exploit Maturity: PoC / Conceptual
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Note
  • siyuan: < v3.7.3 (Fixed in: v3.7.3)

Code Analysis

Commit: 69db783

Enforce model.CheckAdminRole middleware check on getHeadingLevelTransaction, getHeadingDeleteTransaction, and getHeadingInsertTransaction endpoints

Exploit Details

Mitigation Strategies

  • Upgrade SiYuan Note to version v3.7.3 or later
  • Disable Publish Mode if public reading access is not required
  • Deploy reverse proxy or WAF rules to restrict access to affected transaction endpoints

Remediation Steps:

  1. Identify the version of SiYuan Note currently running in the environment
  2. Obtain version v3.7.3 or a newer release from the official repository
  3. Apply the update according to the deployment guidelines (Docker, local package, or server binaries)
  4. If immediate patching is impossible, modify your Nginx, Apache, or WAF configuration to block external access to /api/block/getHeadingLevelTransaction, /api/block/getHeadingDeleteTransaction, and /api/block/getHeadingInsertTransaction
  5. Verify the remediation by sending a test request to the transaction endpoints and ensuring a 403 Forbidden response is returned

References

Read the full report for CVE-2026-68587 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)