Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)

SiYuan's publish mode enforces a password check on the primary `getDoc` endpoint via `FilterContentByPublishAccess`, but the endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`, `getHeadingLevelTransaction`, `getHeadingInsertTransaction`, `getBacklinkDoc`, and `getBackmentionDoc` perform no equivalent password check. An anonymous attacker who obtains a protected document's internal block IDs - possible via reader-accessible endpoints that retain block IDs even after content filtering - can call these unprotected endpoints to retrieve the full rendered content of a password-protected document without supplying the required password. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.3. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j72-f6wg-cxw6 Details: https://vuln.today/cve/CVE-2026-68584