SiYuan bug lets anyone bypass note password lock
SiYuan is a note-taking app that lets people publish notes online and lock some pages behind a password. A flaw lets anyone skip that password and read the full contents of a supposedly locked note.
- Severity
- HighCVSS 8.6
- Fix
- Fixed in 0.0.0-20260721020826-2d069dce84a2Fix recorded on Sep 3, 2026
- Affected versions
- before 0.0.0-20260721020826-2d069dce84a2
- Weakness
- CWE-288
- Affects
- SiYuan
How it works
SiYuan checks the password on the main page-view feature, but several other features that also return a note's full content, like loading a heading's contents, editing history for a heading, and backlink lookups, never check the password at all.
What to do
Check the SiYuan kernel build date and commit shown in your instance against 0.0.0-20260721020826-2d069dce84a2. Anything older is affected if publish mode with password-protected documents is in use.
Update SiYuan to kernel build 0.0.0-20260721020826-2d069dce84a2 or later, then confirm the new build is running before trusting password-protected published documents again.
Technical details
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeadingTransaction / getBacklinkDoc (publish mode). CVE: This vulnerability corresponds to CVE-2026-68584.
References
- github.com · GHSA-7j72-f6wg-cxw6 vendor advisory
- nvd.nist.gov · CVE-2026-68584 vdb entry us government resource
- github.com · commit 2d069dc GitHub Advisory vendor advisory
- vulncheck.com · siyuan-before-authentication-bypass-via-content-endpoints GitHub Advisory third party advisory technical description
- osv.dev · GHSA-7J72-F6WG-CXW6 vdb entry