https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:48:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352688 EUVD-2026-352688 https://cve.radiocsirt.org/vuln/euvd-2026-352688 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68584 <p>SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.</p> <p>SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68584 https://cve.radiocsirt.org/vuln/ghsa-7j72-f6wg-cxw6 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-68584](https://nvd.nist.gov/vuln/detail/CVE-2026-68584).</p> <p>### Summary</p> <p>SiYuan&#39;s publish mode defines a &#34;protected&#34; access level: a document that is publicly listed but requires a password to read (per the product&#39;s own UI help text, protected = &#34;Publicly visible, requires password to access&#34;). The password is enforced on the primary content path (`getDoc`, via `FilterContentByPublishAccess`).</p> <p>Several other content-returning endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`/`getHeadingLevelTransaction`/ `getHeadingInsertTransaction`, and `getBacklinkDoc`/`getBackmentionDoc` return rendered block DOM with **no password check at all**. Combined with reader-reachable endpoints that leak a protected document&#39;s internal block IDs, an anonymous reader can retrieve the full body of a password-protected document without the password. This has been reproduced end-to-end on a live instance.</p> <p>### Details</p> <p>**The password control and where it is enforced.** Publish access has five levels encoded in `visible`/`password`/`disable`: public, protected (password), hidden, private (password), forbidden. `getDoc` correctly enforces the password for protected/private documents via `FilterContentByPublishAccess`. The bug is that other content endpoints do not.</p> <p>**Content endpoints with no password check (all `CheckAuth`-only):** - `getHeadingChildrenDOM` returns rendered DOM of a heading subtree. - `getHeadingDeleteTransaction`/`…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-68584](https://nvd.nist.gov/vuln/detail/CVE-2026-68584).</p> <p>### Summary</p> <p>SiYuan&#39;s publish mode defines a &#34;protected&#34; access level: a document that is publicly listed but requires a password to read (per the product&#39;s own UI help text, protected = &#34;Publicly visible, requires password to access&#34;). The password is enforced on the primary content path (`getDoc`, via `FilterContentByPublishAccess`).</p> <p>Several other content-returning endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`/`getHeadingLevelTransaction`/ `getHeadingInsertTransaction`, and `getBacklinkDoc`/`getBackmentionDoc` return rendered block DOM with **no password check at all**. Combined with reader-reachable endpoints that leak a protected document&#39;s internal block IDs, an anonymous reader can retrieve the full body of a password-protected document without the password. This has been reproduced end-to-end on a live instance.</p> <p>### Details</p> <p>**The password control and where it is enforced.** Publish access has five levels encoded in `visible`/`password`/`disable`: public, protected (password), hidden, private (password), forbidden. `getDoc` correctly enforces the password for protected/private documents via `FilterContentByPublishAccess`. The bug is that other content endpoints do not.</p> <p>**Content endpoints with no password check (all `CheckAuth`-only):** - `getHeadingChildrenDOM` returns rendered DOM of a heading subtree. - `getHeadingDeleteTransaction`/`…</p> https://cve.radiocsirt.org/vuln/ghsa-7j72-f6wg-cxw6