CVE-2026-68584: SiYuan Auth Bypass Vulnerability

CVE-2026-68584 Overview

CVE-2026-68584 is an authentication bypass vulnerability in SiYuan, a personal knowledge management application. Versions before v3.7.3 fail to enforce password checks on several content-returning endpoints when publish mode is enabled. While the primary getDoc endpoint is protected, the endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no authentication. Anonymous attackers can enumerate internal block IDs through reader-accessible endpoints and use them to retrieve the full content of password-protected documents. The flaw is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated remote attackers can retrieve the full contents of password-protected SiYuan documents in publish mode without providing credentials.

Affected Products

SiYuan versions prior to v3.7.3
SiYuan instances operating in publish mode with password-protected documents
Self-hosted SiYuan deployments exposed to untrusted networks

Discovery Timeline

2026-08-03 - CVE-2026-68584 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68584

Vulnerability Analysis

SiYuan's publish mode gates access to documents with a password prompt served through the getDoc endpoint. The application enforces authentication on that primary endpoint but omits equivalent checks on adjacent content-returning endpoints. Specifically, getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc return document fragments without verifying that the caller has satisfied the password gate. This inconsistency creates an alternate path to the same protected data. The vulnerability affects confidentiality of stored notes but does not modify data or degrade availability of the service.

Root Cause

The root cause is inconsistent authorization enforcement across endpoints that access the same protected resource. Developers applied password verification only at getDoc rather than at a shared authorization layer covering every content-returning route. This design pattern falls under [CWE-288], where an alternate channel bypasses the primary authentication mechanism. Any endpoint returning document content in publish mode must apply the same access control decision as the guarded endpoint.

Attack Vector

The attack is fully remote and requires no authentication or user interaction. An attacker first queries reader-accessible endpoints to enumerate internal block identifiers for documents rendered in publish mode. With a valid block ID, the attacker issues a direct request to getHeadingChildrenDOM, getHeading*Transaction, or getBacklinkDoc. The server returns the requested content without evaluating the password state. The attacker repeats this pattern to reconstruct full document contents of any password-protected note. No client-side cooperation or session context is required.

Detection Methods for CVE-2026-68584

Indicators of Compromise

Anonymous HTTP POST requests to /api/block/getHeadingChildrenDOM, /api/transactions/getHeading*Transaction, or /api/ref/getBacklinkDoc originating from external IPs.
Sequential requests enumerating block IDs immediately preceded by calls to reader-accessible listing endpoints.
Unexpected access patterns to SiYuan publish-mode instances outside normal user hours or from unfamiliar geographies.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the affected endpoints without a preceding successful password submission to getDoc.
Correlate block ID enumeration bursts with subsequent content-endpoint calls from the same source address.
Alert on any request to the vulnerable endpoints where the SiYuan version banner indicates a build older than v3.7.3.

Monitoring Recommendations

Deploy application-layer logging that records endpoint path, source IP, and authentication state for every SiYuan API call.
Rate-limit unauthenticated requests to publish-mode endpoints and generate alerts on threshold breaches.
Track SiYuan version strings in inventory tooling to identify hosts still exposed to CVE-2026-68584.

How to Mitigate CVE-2026-68584

Immediate Actions Required

Upgrade all SiYuan instances to v3.7.3 or later as the primary remediation for CVE-2026-68584.
Restrict network access to SiYuan publish-mode endpoints until patching completes.
Rotate document passwords after upgrading if publish-mode content may have been exposed.

Patch Information

The SiYuan maintainers resolved the issue in v3.7.3 by adding password verification to getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc. Details are published in the GitHub Security Advisory GHSA-7j72-f6wg-cxw6 and the VulnCheck Advisory.

Workarounds

Disable publish mode for any workspace containing password-protected documents until the upgrade is applied.
Place SiYuan behind a reverse proxy that blocks external access to getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc.
Move sensitive notes out of publish-mode workspaces on unpatched hosts.

bash

# Example nginx rule to block the vulnerable endpoints until patching completes
location ~ ^/api/(block/getHeadingChildrenDOM|transactions/getHeading.*Transaction|ref/getBacklinkDoc)$ {
    deny all;
    return 403;
}