SiYuan bug leaks private notes to anyone

Published September 3, 2026 CVE-2026-68587

SiYuan is a note-taking app that lets people publish selected notebooks to the web while keeping others private. A flaw lets anyone, even without logging in, pull the full text of notes that were never meant to be public.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 0.0.0-20260721013353-69db783b782aFix recorded on Aug 26, 2026
Affected versions
before 0.0.0-20260721013353-69db783b782a
Weakness
CWE-862Missing Authorization
Exploit likelihood
0.25% in 30 daysEPSS, higher than 16% of known flaws
Affects
SiYuan

How it works

Three built-in functions that generate the on-screen view of a heading and its content skip the normal check for whether that document is allowed to be shown publicly, so anyone who knows or guesses a heading's ID can pull its full rendered text.

What to do

Check your SiYuan version in the app or server info page and compare it against v3.7.3. If it is older than v3.7.3, your publish-disabled documents may be readable by anyone who has a heading block ID.

Update SiYuan to v3.7.3 or later through the app's built-in updater or your package manager, then confirm the new version is installed.

Technical details

CVE-2026-68587 (CVSS 8.6) affects SiYuan before v3.7.3. The getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints return rendered block DOM without enforcing publish-access checks (CWE-862, missing authorization). Anonymous callers or accounts holding only a publish RoleReader token can pass a heading block ID and receive the full rendered content of documents that have publish access disabled, bypassing the intended restriction on what non-published content can be read.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source