Executive Summary
A critical vulnerability (CVE-2026-68587) has been discovered in SiYuan versions before v3.7.3. This vulnerability allows anonymous readers or users with publish RoleReader tokens to access restricted content, posing a significant risk to data confidentiality. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity.
Technical Analysis
CVE-2026-68587 is an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints of SiYuan. The vulnerability occurs because these endpoints return rendered block DOM without proper publish-access checks. An attacker can supply a heading block ID to read the full rendered content of publish-disabled documents that should be restricted.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by sending a request to the affected endpoints with a valid heading block ID. The attacker does not require any special privileges or authentication, making this vulnerability easily exploitable. When the request is processed, the server returns the rendered block DOM, potentially exposing sensitive content of publish-disabled documents.
Impact Assessment
SiYuan versions before v3.7.3 are affected by this vulnerability. An attacker can achieve unauthorized access to restricted content, potentially leading to data breaches and compromising data confidentiality. The CVSS score of 8.6 indicates a high severity level, emphasizing the need for immediate action.
Recommended Actions
To mitigate this vulnerability, users should update SiYuan to version 3.7.3 or later. Additionally, administrators should:
- Restrict access to the affected endpoints for users with publish RoleReader tokens.
- Implement network segmentation to limit the attack surface.
- Monitor for suspicious activity and implement logging and auditing to detect potential exploitation attempts.
Sources
- National Vulnerability Database (NVD)
- SiYuan Security Advisories
- Vulncheck