SiYuan bug exposes private notes in publish mode

Published September 3, 2026 CVE-2026-68586

SiYuan is a note-taking app that lets people share some notes publicly while keeping others private. A bug lets a visitor to a public SiYuan notebook pull up the full content of notes the owner marked as private, and even check whether a private note links to a specific note.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 0.0.0-20260721014413-f45749a7ef6eFix recorded on Aug 26, 2026
Affected versions
before 0.0.0-20260721014413-f45749a7ef6e
Weakness
CWE-862Missing Authorization
Exploit likelihood
0.24% in 30 daysEPSS, higher than 15% of known flaws
Affects
SiYuan

How it works

SiYuan's publish mode is supposed to hide any note not explicitly shared, but two of its data endpoints, getBacklinkDoc and getBackmentionDoc, only check that a visitor is logged in and never check whether that specific note was actually published, so requesting a private note's ID by hand returns its full rendered content anyway.

What to do

Check your SiYuan version in the version screen. The flaw affects publish-mode servers running SiYuan versions older than 3.7.3, and is worse if publish Basic Auth is turned off. Update to SiYuan 3.7.3 or later, and until you do, turn on Basic Auth for your published notebook or take it offline.

Technical details

The publish-mode backlink list endpoints correctly filter out documents the owner has not published, but the corresponding content endpoints, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc, are gated only by CheckAuth and skip that publish-access filter. A publish-mode reader, including an anonymous one when publish Basic Auth is disabled, can request a forbidden document's ID directly and get its rendered DOM content, plus use the response to infer whether that document references a given block. Fixed in SiYuan 3.7.3.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source