SiYuan CVE-2026-68586

The target must be running SiYuan in publish mode and expose the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints to the attacker; the attacker must supply a valid publish-forbidden document ID (obtainable via enumeration or prior knowledge). Fully anonymous exploitation requires that publish Basic Auth is DISABLED - the description explicitly states this. Limiting factors: if publish Basic Auth is enabled, the attacker needs valid publish-reader credentials (the endpoint still enforces CheckAuth); if publish mode is not enabled at all, the endpoints are not exposed in the publish context; and the attacker needs knowledge or guessing of the internal document ID. Impact is limited to information disclosure (read-only) - no modification or denial of service is possible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H, score 9.2) describes a network-reachable, low-complexity, no-privilege, no-interaction confidentiality breach, which is internally consistent with the description's claim that even anonymous readers can exploit it when publish Basic Auth is disabled. The impact is strictly confidentiality (VI/VA/N): no integrity or availability effect. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation signal is currently low despite the high CVSS - this reads as a genuine but not yet mass-exploited issue. One important nuance the raw score obscures: PR:N is only accurate when publish mode is enabled AND Basic Auth is disabled; deployments that keep publish Basic Auth on effectively require valid publish credentials, lowering practical risk. Treat as high priority for internet-exposed publish instances, medium for authenticated-publish or non-published instances.

An attacker who can reach an internet-exposed SiYuan publish endpoint with Basic Auth disabled sends a direct HTTP request to /api/ref/getBacklinkDoc supplying the ID of a document the owner marked publish-forbidden. The server returns the rendered DOM of that hidden document, and by probing getBackmentionDoc the attacker uses the reference-existence oracle to confirm whether the hidden document references specific blocks - leaking confidential notes without any credentials. No public POC was provided, but the low attack complexity makes exploitation trivial once a target ID is known or enumerated.