CVE-2026-72812

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description A missing authorization issue exists in the '/api/ref/refreshBacklink' endpoint. This allows anonymous readers to trigger persistent server-side writes by invoking the endpoint with a controlled block ID. This action flushes transaction queues, scans all references globally, and enqueues database writes, which bypasses read-only protections and enables resource amplification attacks.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary workaround, restrict access to the '/api/ref/refreshBacklink' endpoint to minimize the risk of exploitation.