DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-7J72-F6WG-CXW6: CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan

#security #cve #cybersecurity

CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan

Vulnerability ID: GHSA-7J72-F6WG-CXW6
CVSS Score: 8.6
Published: 2026-09-03

An authentication bypass vulnerability (classified as CWE-288) exists in the publish-mode component of SiYuan, a Go-based note-taking application. This security flaw allows unauthenticated remote attackers to bypass password-protected note boundaries by leveraging auxiliary block endpoints that fail to enforce document access checks. Attackers can exploit this issue by first harvesting document metadata via a public search endpoint and subsequently fetching full rendered document contents using vulnerable block endpoints. This technical analysis explores the root cause, exploitation methodology, and remediation path.

TL;DR

An unauthenticated remote attacker can bypass password protection on published notes in SiYuan by retrieving block IDs through search metadata leaks and querying auxiliary block endpoints directly.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.6
  • EPSS Score: Not available
  • Impact: High (Complete loss of confidentiality of protected documents)
  • Exploit Status: Proof-of-Concept (PoC)
  • CISA KEV Status: Not listed

Affected Systems

  • SiYuan (Go Kernel Backend)
  • SiYuan: < 0.0.0-20260721020826-2d069dce84a2 (Fixed in: 0.0.0-20260721020826-2d069dce84a2)

Code Analysis

Commit: 2d069dc

Fix publish auth bypass by enforcing checkBlockPublishAccess inside block API handlers

diff --git a/kernel/api/block.go b/kernel/api/block.go\nindex b08b2ff9139..983bab5117c 100644\n--- a/kernel/api/block.go\n+++ b/kernel/api/block.go\n@@ -188,6 +188,10 @@ func getHeadingChildrenIDs(c *gin.Context) {\n \t}\n \n \tid := arg["id"].(string)\n+\tif !checkBlockPublishAccess(c, id, ret) {\n+\t\treturn\n+\t}\n +\n \tids := model.GetHeadingChildrenIDs(id)\n \tret.Data = ids\n }\n@@ -216,6 +220,10 @@ func getHeadingChildrenDOM(c *gin.Context) {\n \t}\n \n \tid := arg["id"].(string)\n+\tif !checkBlockPublishAccess(c, id, ret) {\n+\t\treturn\n+\t}\n +\n \tremoveFoldAttr := true\n \tif nil != arg["removeFoldAttr"] {\n \t\tremoveFoldAttr = arg["removeFoldAttr"].(bool)
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Advisory: Official advisory detailing the security bypass chain in SiYuan publish mode.

Mitigation Strategies

  • Upgrade to the latest patched version of SiYuan.
  • Deploy a reverse proxy (e.g., Nginx) to block external access to vulnerable auxiliary block API endpoints.
  • Limit access to the SiYuan publish-mode port (6808) to trusted networks or IP addresses.
  • Disable publish mode entirely if it is not required for daily operations.

Remediation Steps:

  1. Identify all running instances of SiYuan in the environment.
  2. Verify the version of each instance by checking the kernel build metadata.
  3. Apply the patch by updating the container image or application binary to version 0.0.0-20260721020826-2d069dce84a2 or newer.
  4. If patching is delayed, update reverse proxy configurations to deny unauthenticated traffic to /api/block/getHeading routes.

References

Read the full report for GHSA-7J72-F6WG-CXW6 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)