VulnSocial

CVE-2026-68586Disclosure

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-01: 1Mentions · 2026-09-04: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-04: 109-0109-04
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • SECNORA®@secnorainfosec
    Disclosure

    🚨 CVE-2026-68586 (CVSS 9.2, Critical): A missing check in SiYuan's "getBacklinkDoc" and "getBackmentionDoc" exposed forbidden documents to anonymous readers, no login needed. 🔓 Read full blog: https://secnora.com/blog/cve-2026-68586-siyuan-backlink-bypass/

    Post summary

    The alert highlights a critical missing check in SiYuan's backlink and backmention features, exposing forbidden documents to anonymous users, but provides no evidence of active exploitation or mitigation.

    0002076
    77 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🟠 SiYuan Note, Missing Authorization, #CVE-2026-68586 (Medium) -DC-Sep2026-2169 https://dailycve.com/siyuan-note-missing-authorization-cve-2026-68586-medium-dc-sep2026-2169/

    Post summary

    The text announces the discovery of a medium‑severity missing authorization vulnerability (CVE‑2026‑68586) in SiYuan Note, as reported by DailyCVE.

    0000035
    233 followersView on X

Explore more

Back to dashboard