CVE-2026-68586: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
The backlink API splits into list endpoints (which documents reference a block) and content endpoints (the rendered text of those referencing blocks). The list endpoints apply a publish-access filter, the content endpoints do not. As a result, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc return the rendered DOM of blocks belonging to a publish-forbidden document to an anonymous reader, with no access check.
Both content endpoints are gated by CheckAuth only, reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
References
- github.com/advisories/GHSA-36v8-mpjm-8j5r
- github.com/siyuan-note/siyuan/commit/f45749a7ef6e385f6e2af6b7dd12429d56d46f32
- github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r
- nvd.nist.gov/vuln/detail/CVE-2026-68586
- www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc
Code Behaviors & Features
Detect and mitigate CVE-2026-68586 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →