Summary
CVE-2026-68586 is a missing authorization (CWE-862) vulnerability in SiYuan, an open-source note-taking application. In publish mode, the backlink content endpoints fail to enforce publish-access restrictions, allowing an unauthorized reader to retrieve the rendered content of publish-forbidden documents. The issue affects all versions before v3.7.3 and is rated critical.
Technical details
- Root cause: The
/api/ref/getBacklinkDocand/api/ref/getBackmentionDocendpoints are gated byCheckAuthonly and do not apply the publish-access filtering that their list-endpoint counterparts enforce, creating an authorization asymmetry. - Trigger conditions: Publish mode is enabled with Basic Auth disabled (permitting anonymous readers), or the attacker holds a valid publish RoleReader token. The attacker must supply a publish-forbidden document’s ID and a block it references.
- Attack vector: Network. An attacker calls the affected endpoints directly; no admin credentials, CSRF tokens, or write permissions are required.
- Impact: Confidentiality breach. The attacker retrieves the rendered DOM content of restricted documents and can infer reference relationships between documents. No data modification occurs.
Affected software
- SiYuan (siyuan-note/siyuan) v3.7.2 and all earlier versions.
Severity
- CVSS v3.1 base score: 8.6 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Upgrade to SiYuan v3.7.3 or later, which applies publish-access filtering to the affected content endpoints.
- If no patch can be applied: Enable publish Basic Auth so anonymous readers cannot reach the endpoints, and restrict network access to the publish service to trusted users only.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Page title:
Access Authorization - SiYuan,思源笔记 - Raw response body:
exitSiYuan,b3log.org/siyuan

