Missing Authorization Vulnerability in SiYuan by SiYuan Note

CVE-2026-72812

What is CVE-2026-72812?

SiYuan versions prior to v3.7.4 exhibit a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint. This flaw allows anonymous users to invoke the endpoint with an attacker-controlled block ID. As a result, unauthorized parties can trigger persistent server-side writes, thereby circumventing read-only protections. This vulnerability facilitates capabilities such as flushing transaction queues, scanning references globally, and enqueuing database writes, ultimately enabling potential resource amplification attacks.

References