Authentication Bypass in SiYuan Document Management Software

CVE-2026-68584

What is CVE-2026-68584?

SiYuan versions prior to v3.7.3 are vulnerable to an authentication bypass in publish mode, allowing unauthorized users to access the full content of password-protected documents. Attackers can exploit this flaw by leveraging internal block IDs from accessible endpoints. Although the primary getDoc endpoint is secured, the related endpoints, such as getHeadingChildrenDOM and getBacklinkDoc, lack necessary password checks. This vulnerability enables anonymous exploitation without requiring user credentials, posing significant risks of data exposure.

References