{"vulnerability": "cve-2026-68586", "sightings": [{"uuid": "62c4d54d-c8e0-4fef-8d97-2cb2d981e526", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68586", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyhkwq72o", "content": "CVE-2026-68586 - siyuan\nSiYuan before version 3.7.3 has a security weakness that allows anyone to see the content of documents they shouldn't have access to. This could be a problem if you have sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:56:06.516862Z"}, {"uuid": "8ac2fc48-744e-4ac7-a3a2-3ef0c8ed6196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68586", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-36v8-mpjm-8j5r", "content": "", "creation_timestamp": "2026-09-03T22:35:05.211907Z"}, {"uuid": "41b317f9-cac6-445b-b4f9-dcf85e901ba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68586", "type": "seen", "source": "https://gist.github.com/alon710/20f1059adcde1e4a5f6beaa48bfa0228", "content": "# CVE-2026-68586: CVE-2026-68586: Missing Authorization in SiYuan Backlink Content Endpoints Allows Information Disclosure\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68586\n\n## Summary\nSiYuan is a privacy-first personal knowledge management system. In versions prior to v3.7.3, the application fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints correctly filter out publish-forbidden documents, the content endpoints, which are only gated by high-level route authorization checks via CheckAuth, do not. Consequently, a user with low-privilege read access, or an anonymous reader when publish Basic Auth is disabled, can directly invoke these endpoints using a known publish-forbidden document's ID to retrieve its rendered DOM content or determine whether it references a specific target block.\n\n## TL;DR\nAn authorization bypass flaw in SiYuan's reference content retrieval API endpoints allows unauthorized readers to fetch the fully rendered DOM of publish-restricted documents using known document identifiers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (Remote)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **CVSS v3.1 Score**: 8.6 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v3.7.3\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.3 (Fixed in: `3.7.3`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.3 or higher.\n- Enable Publish Basic Authentication to restrict access to authorized readers only.\n- Disable the web publishing feature entirely if public note access is not required.\n- Deploy reverse proxy rules or WAF policies to monitor and filter traffic to the affected API endpoints.\n\n**Remediation Steps:**\n1. Identify all running instances of SiYuan in the environment.\n2. Verify the currently installed version using the system settings or by querying the version metadata.\n3. If the version is prior to 3.7.3, download the latest release from the official repository or update the Docker container image.\n4. Apply the update and restart the service.\n5. Configure basic authentication under the publish settings if public note hosting must remain active.\n6. Verify remediation by attempting to query the /api/ref/getBacklinkDoc endpoint as an unauthenticated reader.\n\n## References\n\n- [GitHub Security Advisory GHSA-36v8-mpjm-8j5r](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc)\n- [SiYuan Fix Commit](https://github.com/siyuan-note/siyuan/commit/f45749a7ef6e385f6e2af6b7dd12429d56d46f32)\n- [NVD CVE Detail Link](https://nvd.nist.gov/vuln/detail/CVE-2026-68586)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-68586)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68586) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T14:31:53.055495Z"}]}