CVE-2026-68586 in siyuan
Summary
by MITRE • 08/03/2026
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists in SiYuan versions prior to 3.7.3 where the application fails to properly enforce publish-access filters on specific content retrieval endpoints. The flaw manifests in the distinction between two types of API endpoints that handle backlink and backmention data. While the list-based endpoints correctly filter out documents that are forbidden for publication, the corresponding content endpoints lack this crucial access control mechanism. These content endpoints are accessible through the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc paths and are only protected by a basic CheckAuth mechanism rather than comprehensive publish-access validation.
The technical implementation issue stems from inconsistent security enforcement across similar API functions within the SiYuan application architecture. When a user accesses these content endpoints, they can directly query any document ID regardless of the document's publication status or access restrictions. This creates a significant information disclosure vulnerability where unauthorized parties can retrieve rendered DOM content from documents that should be restricted to publish-mode readers only. The vulnerability operates at the application layer and affects the authentication and authorization mechanisms that govern content access.
The operational impact of this vulnerability is substantial as it enables what security researchers term a reference-existence oracle attack pattern. An attacker with minimal privileges including anonymous access when publish Basic Auth is disabled can systematically determine document relationships within the system. This capability allows for reconnaissance activities where adversaries can map out document structures and identify referenced content without proper authorization. The rendered DOM content exposure provides attackers with detailed information about document formatting and structure that may aid in further exploitation attempts.
This vulnerability aligns with CWE-284 which describes improper access control, specifically addressing inadequate enforcement of access restrictions on application resources. The flaw also corresponds to ATT&CK technique T1078 which covers valid accounts and credential access, as the vulnerability allows unauthorized access to restricted content through legitimate API endpoints. Additionally, this represents a privilege escalation vector under ATT&CK T1068 where an attacker can gain access to content beyond their intended authorization level. The security implications extend beyond simple information disclosure to potentially enable more sophisticated attacks including data exfiltration and system reconnaissance.
Organizations using SiYuan should immediately implement the available patch or update to version 3.7.3 which addresses this access control flaw by ensuring that both list and content endpoints properly enforce publish-access filters. The mitigation strategy involves implementing consistent authorization checks across all API endpoints that handle backlink and backmention data, ensuring that the CheckAuth mechanism is supplemented with proper publish-access validation. Security teams should also monitor for unauthorized access attempts to these specific API endpoints and consider implementing additional logging and alerting mechanisms around content retrieval activities to detect potential exploitation of this vulnerability.