Publish-access bypass in SiYuan backlink content endpoints (CVE-2026-68586)

SiYuan's backlink API exposes two content endpoints, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc, that return the rendered DOM of referencing blocks without applying the publish-access filter enforced by the sibling list endpoints. Both endpoints are gated only by CheckAuth, making them reachable by a publish RoleReader token or by an anonymous user when publish Basic Auth is disabled. An unauthenticated reader can supply any document ID-including one explicitly marked publish-forbidden, publish-disabled, or password-protected-to retrieve its rendered HTML content and determine whether it references a given block. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.3. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r Details: https://vuln.today/cve/CVE-2026-68586