CVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r
https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) SiYuan anterior a la v3.7.3 no aplica filtros de acceso de publicación a los endpoints de contenido getBacklinkDoc y getBackmentionDoc (/API/ref/getBacklinkDoc y /API/ref/getBackmentionDoc). Mientras que los endpoints de lista de backlinks correspondientes filtran documentos con publicación prohibida, los endpoints de contenido (protegidos solo por CheckAuth) no lo hacen. Un lector en modo de publicación - incluyendo un lector anónimo cuando la autenticación básica de publicación está deshabilitada - puede llamar a estos endpoints directamente con el ID de un documento con publicación prohibida para recuperar su contenido DOM renderizado y para determinar si el documento hace referencia a un bloque dado (un oráculo de existencia de referencia).

Information

Published : 2026-08-03 14:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-68586

Mitre link : CVE-2026-68586

CVE.ORG link : CVE-2026-68586

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-68586", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68586", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T15:00:19.598554Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "0", "lessThan": "3.7.3", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.3", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel", "defaultStatus": "unaffected"}]}], "published": "2026-08-03T14:16:28.237", "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader \u2014 including an anonymous reader when publish Basic Auth is disabled \u2014 can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle)."}, {"lang": "es", "value": "SiYuan anterior a la v3.7.3 no aplica filtros de acceso de publicaci\u00f3n a los endpoints de contenido getBacklinkDoc y getBackmentionDoc (/API/ref/getBacklinkDoc y /API/ref/getBackmentionDoc). Mientras que los endpoints de lista de backlinks correspondientes filtran documentos con publicaci\u00f3n prohibida, los endpoints de contenido (protegidos solo por CheckAuth) no lo hacen. Un lector en modo de publicaci\u00f3n - incluyendo un lector an\u00f3nimo cuando la autenticaci\u00f3n b\u00e1sica de publicaci\u00f3n est\u00e1 deshabilitada - puede llamar a estos endpoints directamente con el ID de un documento con publicaci\u00f3n prohibida para recuperar su contenido DOM renderizado y para determinar si el documento hace referencia a un bloque dado (un or\u00e1culo de existencia de referencia)."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}