CVE-2026-68587

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description An information disclosure issue exists where the endpoints 'getHeadingDeleteTransaction', 'getHeadingLevelTransaction', and 'getHeadingInsertTransaction' return rendered block DOM without performing publish-access checks. This allows anonymous readers or users with publish RoleReader tokens to provide a heading block ID and read the full rendered content of documents that are disabled for publishing and should be restricted.

Recommendations Update to version 3.7.3 or later.