CVE-2026-68586 Overview
CVE-2026-68586 is a missing authorization flaw [CWE-862] in SiYuan, an open-source personal knowledge management application. Versions before v3.7.3 fail to apply publish-access filters to the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc content endpoints. These endpoints are gated only by CheckAuth, while the corresponding backlink list endpoints correctly filter publish-forbidden documents. A publish-mode reader, including an anonymous reader when publish Basic Auth is disabled, can query these endpoints directly using a publish-forbidden document ID. The attacker retrieves rendered DOM content and confirms whether the document references a given block, creating a reference-existence oracle.
Critical Impact
Unauthenticated remote attackers can retrieve content of documents explicitly marked as publish-forbidden, breaking the confidentiality boundary between private and published notes.
Affected Products
- SiYuan note-taking application versions before v3.7.3
- Deployments exposing the SiYuan publish interface to the network
- Instances running with publish Basic Auth disabled (anonymous exposure)
Discovery Timeline
- 2026-08-03 - CVE-2026-68586 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-68586
Vulnerability Analysis
SiYuan exposes a publish mode that renders selected documents to external readers while restricting access to documents flagged as publish-forbidden. The application enforces this restriction on the backlink list endpoints, which enumerate references to a target block. The list endpoints correctly omit documents that lack publish permission.
The corresponding content endpoints, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc, do not repeat that filter. They rely solely on CheckAuth, which validates the session or Basic Auth credential but does not evaluate publish-access rules on the requested document identifier. An attacker who knows or guesses a document ID can request its rendered DOM directly.
The endpoints also disclose whether a target document references an arbitrary block. This behavior functions as a reference-existence oracle, allowing an attacker to probe private relationships between blocks without direct read access to the source.
Root Cause
The root cause is inconsistent authorization enforcement across related API routes. The list endpoints implement the publish-forbidden filter, while the content endpoints omit that check. This is a classic missing-function-level authorization defect described by CWE-862.
Attack Vector
An attacker reaches the vulnerable endpoints over the network with no privileges and no user interaction. When publish Basic Auth is disabled, an anonymous HTTP client can invoke the endpoints directly. The attacker submits a POST request containing a publish-forbidden document ID and reads the rendered HTML from the response body. Successive requests with varied block IDs enumerate reference relationships.
See the GitHub Security Advisory and the VulnCheck Advisory on Siyuan for endpoint-level technical detail.
Detection Methods for CVE-2026-68586
Indicators of Compromise
- HTTP POST requests to /api/ref/getBacklinkDoc or /api/ref/getBackmentionDoc originating from unauthenticated or unexpected client IPs
- Repeated requests to the two endpoints iterating through document IDs or block IDs within short time windows
- Requests to these endpoints where the referenced document has publish-forbidden status
Detection Strategies
- Enable request logging on the SiYuan reverse proxy or web server and alert on access to /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc from clients that have not authenticated to the publish interface
- Correlate access to these endpoints against the publish-forbidden document set exported from SiYuan configuration
- Baseline normal request volume to backlink endpoints and alert on sudden increases indicative of enumeration
Monitoring Recommendations
- Forward SiYuan and upstream proxy logs to a central log platform and retain full request URIs and source IPs
- Monitor for anonymous access when publish Basic Auth is expected to be enabled, indicating a misconfiguration or bypass
- Track outbound bandwidth from the SiYuan host for anomalous spikes consistent with bulk DOM extraction
How to Mitigate CVE-2026-68586
Immediate Actions Required
- Upgrade SiYuan to v3.7.3 or later, which applies the publish-access filter to both content endpoints
- Enable publish Basic Auth and set a strong credential to prevent anonymous access to the publish interface
- Restrict network exposure of the SiYuan publish port to trusted networks or a VPN until patching is complete
Patch Information
The maintainers fixed the issue in SiYuan v3.7.3 by applying the same publish-forbidden filter used on the backlink list endpoints to /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. Refer to the GitHub Security Advisory GHSA-36v8-mpjm-8j5r for release notes and commit references.
Workarounds
- Block external access to /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc at a reverse proxy until the upgrade is applied
- Require Basic Auth on the publish interface and rotate credentials for any deployment previously exposed anonymously
- Audit publish-forbidden documents for potentially sensitive content and treat exposed material as disclosed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
