Information disclosure in SiYuan via getHeading*Transaction endpoints (CVE-2026-68587)

Three heading transaction endpoints in SiYuan's publish mode (`/api/block/getHeadingDeleteTransaction`, `/api/block/getHeadingLevelTransaction`, and `/api/block/getHeadingInsertTransaction`) return rendered block DOM without performing publish-access checks. These endpoints are gated by `CheckAuth` only, making them reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is false. An unauthenticated or reader-role caller who supplies a heading block ID can read the full rendered content of documents explicitly marked publish-disabled by an administrator, bypassing the access control that the standard reader-facing content path correctly enforces. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.3. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-69mh-gvh4-8gp7 Details: https://vuln.today/cve/CVE-2026-68587