CVE-2026-68586

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description Insufficient publish-access filters are applied to the content endpoints '/api/ref/getBacklinkDoc' and '/api/ref/getBackmentionDoc'. While backlink list endpoints correctly filter documents forbidden from being published, these specific content endpoints only require authentication via CheckAuth. This allows a reader in publish-mode, including anonymous users if Basic Auth is disabled, to directly access these endpoints using a forbidden document's ID. Consequently, an attacker can retrieve the rendered DOM content of the document and use it as a reference-existence oracle to determine if the document references a specific block.

Recommendations Update SiYuan to version 3.7.3 or later.