https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:02:03.527441+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352688 EUVD-2026-352688 2026-10-07T13:02:03.574876+00:00 EUVD-2026-352688 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68584 fkie_cve-2026-68584 2026-10-07T13:02:03.574914+00:00

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.

 https://cve.radiocsirt.org/vuln/ghsa-7j72-f6wg-cxw6 GHSA-7j72-f6wg-cxw6 — SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBackli… 2026-10-07T13:02:03.574950+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

**CVE:** This vulnerability corresponds to [CVE-2026-68584](https://nvd.nist.gov/vuln/detail/CVE-2026-68584).

### Summary

SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read (per the product's own UI help text, protected = "Publicly visible, requires password to access"). The password is enforced on the primary content path (`getDoc`, via `FilterContentByPublishAccess`).

Several other content-returning endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`/`getHeadingLevelTransaction`/ `getHeadingInsertTransaction`, and `getBacklinkDoc`/`getBackmentionDoc` return rendered block DOM with **no password check at all**. Combined with reader-reachable endpoints that leak a protected document's internal block IDs, an anonymous reader can retrieve the full body of a password-protected document without the password. This has been reproduced end-to-end on a live instance.

### Details

**The password control and where it is enforced.** Publish access has five levels encoded in `visible`/`password`/`disable`: public, protected (password), hidden, private (password), forbidden. `getDoc` correctly enforces the password for protected/private documents via `FilterContentByPublishAccess`. The bug is that other content endpoints do not.

**Content endpoints with no password check (all `CheckAuth`-only):** - `getHeadingChildrenDOM` returns rendered DOM of a heading subtree. - `getHeadingDeleteTransaction`/`…