CVE-2026-68584

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description An authentication bypass exists in publish mode where specific content-returning endpoints do not perform password checks, even though the primary getDoc endpoint is protected. Anonymous attackers can retrieve the full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling the unprotected endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc to bypass the password gate.

Recommendations Update to version 3.7.3 or later. As a temporary workaround, restrict access to the getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc endpoints.