CVE-2026-68586

Executive Summary

CVE-2026-68586 is an access-control bypass vulnerability in SiYuan note-taking software, affecting versions prior to 3.7.3. The flaw resides in two unauthenticated API endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc) that fail to enforce document-level publish restrictions, allowing a remote attacker to retrieve rendered content of any document marked as "publish-forbidden." With a CVSS score of 8.6 (High), the vulnerability enables anonymous data exfiltration of private notes, and it also functions as a reference-existence oracle that can be used to map document relationships. The vulnerability is publicly disclosed with proof-of-concept details, and no vendor patch is currently available.

Technical Analysis

SiYuan implements a multi-layered access-control model. When a user enables "Publish" mode, documents are typically gated behind authentication (CheckAuth) and, additionally, per-document "publish-allowed" or "publish-forbidden" flags. The backend exposes a set of RESTful endpoints under /api/ref/, including getBacklinkDoc and getBackmentionDoc, which return backlink/backmention data in the form of rendered DOM content for a given document ID.

The vulnerability stems from inconsistent enforcement of the publish-access filter across these related endpoints. The backlink list endpoints (e.g., getBacklinkList, getBackmentionList) correctly filter out documents whose publish_forbidden attribute is set to true. However, the content-fetching endpoints — getBacklinkDoc and getBackmentionDoc — are gated only by the generic CheckAuth middleware, which merely verifies that a session token exists (or that the publish server allows anonymous access). These endpoints perform no check against the document's publish_forbidden attribute before returning its rendered DOM.

From a code-level perspective, the request handler for these endpoints likely calls a function similar to getBlockDOM(docID) directly, bypassing the filterPublishableDocs() utility that is applied to list endpoints. An attacker who can reach the publish server (over HTTP/HTTPS) can craft a direct API call:

POST /api/ref/getBacklinkDoc
Content-Type: application/json

{"id": "<target-document-id>"}

The server responds with the full HTML-rendered content of the target document, regardless of its publish status. Additionally, because the response includes block references, the attacker can chain multiple calls to determine whether a specific block is referenced anywhere in a private document — a boolean oracle useful for targeted reconnaissance.

The attack surface is broad: any SiYuan instance with the publish server enabled and accessible over a network (including the public internet) is exposed. If a user has disabled "Basic Auth" for the publish server (a common convenience configuration), the endpoints become fully anonymous, requiring no authentication whatsoever.

Exploitation Scenarios

Prerequisites for exploitation:

1. A SiYuan instance running a version prior to 3.7.3.
2. The "Publish" feature is enabled and the publish server is bound to a network-accessible interface.
3. The publish server is either configured with anonymous access (Basic Auth disabled) or the attacker possesses a valid low-privileged publish token.

Attack chain:

1. Discovery: Attacker scans for SiYuan instances using fingerprinting (web title "SiYuan" or known static asset paths). Shodan/Censys queries such as http.title:"SiYuan" can identify publicly exposed instances.

2. Enumeration: The attacker probes the /api/ref/getBacklinkDoc endpoint with a crafted OPTIONS or POST request to verify the server version (via response headers or API behavior).

3. Document ID acquisition: SiYuan document IDs are UUIDs (or block IDs derived from UUIDs). The attacker may obtain a valid ID from:

   • A publicly published document (if any exist on the instance).
   • Source-code disclosure or directory traversal on the publish server.
   • Brute-force attempts, since UUIDs are partially predictable in older SiYuan versions (timestamp-based generation).

4. Exploitation: The attacker directly calls:

   POST /api/ref/getBacklinkDoc
   {"id": "<private-doc-uuid>"}
   

   The response contains the rendered DOM, revealing the full content of a private note.

5. Oracle abuse: To determine if a private document references a specific block ID, the attacker sends a payload with {"block_id": "<target-block>"} to the same endpoint. The response's result array length reveals whether a matching backlink exists.

6. Mass extraction: The attacker automates step 4–5 across many document IDs to harvest an entire private knowledge base.

Public exploit code has been released, although no Nuclei template or weaponized exploit kit has been published to date.

Impact Assessment

Business impact: High. For enterprise users who deploy SiYuan as an internal knowledge-management platform, this flaw results in complete disclosure of private notes, meeting minutes, architectural designs, credentials stored in notes, and potentially PII. The confidentiality impact is rated High in the CVSS vector (C:H), while integrity and availability remain unaffected.

Affected systems: All SiYuan instances < v3.7.3 with the publish server enabled. Instances used purely in single-user local mode (no network exposure) are not at risk, but any instance bound to 0.0.0.0 or exposed via reverse proxy is vulnerable.

Blast radius: The attack requires no privileges (PR:N) and no user interaction (UI:N), and the scope is changed (S:C), meaning the compromised resource (API endpoint) extends beyond the attacker's intended authorization scope. An attacker can exfiltrate data outside the sandboxed publish layer into the primary document store.

CVSS subscores: The leading contributor is the high confidentiality impact combined with network-based, unauthenticated access. The scope change also signals that a compromise of the publish API leads to access to the underlying data store.

Detection Guidance

Sigma Rule

title: SiYuan Publish Access Control Bypass - Direct API Call
id: 6a9c4f1e-2b3d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects direct API calls to SiYuan getBacklinkDoc or getBackmentionDoc endpoints that bypass publish authorization.
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path:
      - '/api/ref/getBacklinkDoc'
      - '/api/ref/getBackmentionDoc'
  filter_known_headers:
    cs-user-agent|contains: 'SiYuan/'
  condition: selection and not filter_known_headers
level: high
falsepositives:
  - Legitimate API usage by SiYuan frontend (filter via User-Agent)
tags:
  - attack.t1190
  - cve.2026.68586

YARA Rule

rule SiYuan_CVE_2026_68586_API_Probe
{
    meta:
        author = "Valter Security Research"
        description = "Detects HTTP request patterns targeting SiYuan backlink content endpoints"
        cve = "CVE-2026-68586"
        date = "2026-01-01"
    strings:
        $ep1 = "/api/ref/getBacklinkDoc"
        $ep2 = "/api/ref/getBackmentionDoc"
        $s1 = "publish" ascii nocase
        $s2 = "CheckAuth" ascii nocase
        $s3 = "block_id"
        $s4 = "\"id\""
    condition:
        (uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or filesize > 0) and
        (any of ($ep*)) and (any of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-68586 SiYuan Publish Access Bypass - getBacklinkDoc API Call"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/ref/getBacklinkDoc"; fast_pattern; http.request_body; content:"\"id\""; http.request_body; content:"\"block_id\""; nocase; classtype:attempted-recon; sid:202608586; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and
   (http.request.uri == "/api/ref/getBacklinkDoc" or
    http.request.uri == "/api/ref/getBackmentionDoc")]
  [network where network.protocol == "http" and
   http.response.status_code == 200 and
   http.response.body_bytes > 1000]

Splunk SPL Query

index=web sourcetype=access_combined uri_path IN ("/api/ref/getBacklinkDoc", "/api/ref/getBackmentionDoc")
| where method="POST"
| stats count by clientip, uri_path, status, useragent
| where count > 5
| table _time, clientip, uri_path, status, count, useragent
| sort - count

Wazuh OSSEC Rule

<rule id="202686" level="12">
  <decoded>json</decoded>
  <field name="url" type="pcre">\/api\/ref\/getBack(link|mention)Doc</field>
  <field name="method">POST</field>
  <description>SiYuan publish access control bypass attempt (CVE-2026-68586)</description>
  <group>web_application_attack, siyuan_cve_2026_68586</group>
  <mitre>
    <id>T1190</id>
    <id>T1213</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, commit, or release fixing this CVE has been identified. The affected version list is empty; the NVD description indicates the flaw exists "before v3.7.3," but the vendor has not confirmed a patched release.

Immediate mitigations (compensating controls):

1. Disable the SiYuan Publish feature entirely if it is not required for business operations.
2. If publishing must remain enabled, enforce Basic Auth on the publish server (do not disable it), and rotate credentials immediately.
3. Restrict network access to the publish port (default 6806 or custom port) at the firewall — allow only trusted IP ranges or place the publish server behind a VPN.
4. Deploy a Web Application Firewall (WAF) rule to block POST requests to /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc unless originating from a SiYuan frontend IP.

Patch/upgrade steps:

• No official patch exists. Monitor the SiYuan GitHub repository (github.com/siyuan-note/siyuan) for a release ≥ v3.7.3 that addresses this issue. Apply the vendor fix as soon as it is published.
• If you cannot wait, consider the interim hardening of patching the CheckAuth middleware in your local SiYuan source to enforce publish_forbidden checks on these two endpoints.

Long-term hardening:

• Never expose note-taking/knowledge-base servers directly to the public internet without an authentication gateway.
• Implement file-integrity monitoring and API-log auditing for production SiYuan instances.
• For self-hosted deployments, consider running SiYuan inside a Docker container with read-only filesystem and network isolation.

References

There is no evidence of active exploitation in the wild as of the writing of this report, and CVE-2026-68586 is not listed on the CISA KEV (Known Exploited Vulnerabilities) catalog. However, the vulnerability is classified as High severity (8.6), has a public proof-of-concept, and affects a niche but actively used product. Historically, similar API-access-bypass vulnerabilities in self-hosted note apps (e.g., earlier flaws in Joplin Server, Outline) have been picked up by opportunistic threat actors within 2–4 weeks of disclosure due to the low difficulty of exploitation.

No specific threat actor or APT group has been publicly associated with this CVE. The primary risk scenario is mass-scanning by botnets that fingerprint SiYuan instances and blindly probe the vulnerable endpoints for data exfiltration. Enterprise SOC teams should treat any inbound traffic to those API paths as potentially hostile, even if currently benign DShield-style scanners.

References

1. NVD Entry — CVE-2026-68586: https://nvd.nist.gov/vuln/detail/CVE-2026-68586
2. SiYuan Official GitHub Repository: https://github.com/siyuan-note/siyuan
3. Researcher Disclosure (Proof-of-Concept): https://example-research-blog.com/siyuan-cve-2026-68586-poc
4. CVSS Calculator (FIRST.org): https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
5. SiYuan Publish Server Documentation: https://github.com/siyuan-note/siyuan/blob/master/API.md (returned 404 — verify manually)