CVE-2026-68587: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

Three “heading transaction” endpoints /api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction return the rendered block DOM of a heading and its subtree in the computed transaction payload, with no publish-access check. They are gated by CheckAuth only, so they are reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false.

Despite their write-implying names, these endpoints perform no mutation on this path, they compute a transaction object and return it, and that object contains RenderNodeBlockDOM output. As a result, an anonymous reader who supplies a heading block ID can read the full rendered content of a document that has been explicitly marked publish-disabled by an administrator, content that the reader-facing /api/filetree/getDoc path correctly refuses to return.