CVE-2026-68587 Overview
CVE-2026-68587 is an information disclosure vulnerability in SiYuan, a personal knowledge management application. Versions before v3.7.3 expose rendered block content through three heading transaction endpoints without enforcing publish-access checks. The affected endpoints are getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction. Anonymous readers or holders of publish RoleReader tokens can submit a heading block ID to retrieve rendered Document Object Model (DOM) content from documents marked as publish-disabled. The flaw maps to CWE-862: Missing Authorization.
Critical Impact
Unauthenticated network attackers can read the full rendered content of publish-restricted documents by supplying a valid heading block ID to the affected endpoints.
Affected Products
- SiYuan versions prior to v3.7.3
- SiYuan publish server component exposing heading transaction endpoints
- Deployments serving RoleReader tokens or anonymous readers
Discovery Timeline
- 2026-08-03 - CVE-2026-68587 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-68587
Vulnerability Analysis
SiYuan exposes a publish server that gates document access based on publish flags and role tokens. Three transaction endpoints tied to heading manipulation, getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction, respond with rendered block DOM. These handlers omit the publish-access check applied elsewhere in the publish surface.
An attacker who knows or guesses a heading block ID can request one of these endpoints and receive the rendered content of the surrounding document. The response includes DOM output that reveals text, structure, and embedded elements from documents the operator intended to keep private. Role enforcement fails uniformly for anonymous callers and for tokens scoped to RoleReader on the publish tier.
Root Cause
The root cause is a missing authorization check in the three transaction handlers. The endpoints assemble rendered block DOM before validating whether the caller holds rights to view the parent document. The publish-disabled flag on the source document is not consulted in the code path that produces the response.
Attack Vector
Exploitation requires only network access to the SiYuan publish endpoint. The attacker sends an HTTP request to one of the vulnerable heading transaction routes with a blockID parameter referencing a heading in a publish-disabled document. No authentication, user interaction, or elevated privileges are required. Block identifiers can be harvested from public documents, enumerated, or obtained from prior reconnaissance.
See the GitHub Security Advisory GHSA-69mh-gvh4-8gp7 and the VulnCheck Advisory on Information Disclosure for endpoint-level details.
Detection Methods for CVE-2026-68587
Indicators of Compromise
- HTTP requests targeting getHeadingDeleteTransaction, getHeadingLevelTransaction, or getHeadingInsertTransaction from unauthenticated sources.
- Repeated requests iterating through candidate blockID values, indicating enumeration of heading identifiers.
- Publish server responses containing rendered DOM for documents flagged as publish-disabled.
Detection Strategies
- Inspect web server and reverse proxy access logs for the three affected endpoint names and correlate with the requesting session or token role.
- Alert on anonymous or RoleReader requests that produce non-empty rendered responses referencing publish-disabled document IDs.
- Baseline normal publish endpoint traffic and flag deviations in request volume against heading transaction routes.
Monitoring Recommendations
- Enable verbose logging on the SiYuan publish server for all heading transaction endpoints and retain request URIs, parameters, and response sizes.
- Forward publish server logs to a centralized analytics platform for correlation with authentication events and role assignments.
- Track outbound response payload size on affected endpoints; unexpected large DOM responses to anonymous callers warrant investigation.
How to Mitigate CVE-2026-68587
Immediate Actions Required
- Upgrade SiYuan to version v3.7.3 or later on all publish server instances.
- Rotate publish RoleReader tokens after upgrading to invalidate any tokens that may have been used against the vulnerable endpoints.
- Audit publish-disabled documents for exposure by reviewing access logs covering the period before the patch was applied.
Patch Information
The fix is included in SiYuan v3.7.3. The upstream patch adds publish-access validation to getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction so the handlers reject requests against publish-disabled documents. Refer to the GitHub Security Advisory GHSA-69mh-gvh4-8gp7 for the release notes and commit references.
Workarounds
- Restrict network access to the SiYuan publish server until the upgrade is completed, allowing only trusted clients through a reverse proxy or VPN.
- Block requests to the three affected endpoints at a web application firewall or reverse proxy when the caller is unauthenticated.
- Temporarily disable the publish feature for documents containing sensitive content until version v3.7.3 is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
