Is CVE-2026-68584 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68584 being exploited in the wild.

How severe is CVE-2026-68584?

High severity, with a CVSS score of 8.6, published 3 September 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260721020826-2d069dce84a2, SEMVER:introduced=0,fixed=0.0.0-20260721020826-2d069dce84a2; SiYuan < 0.0.0-20260721020826-2d069dce84a2.

Is there a fix for CVE-2026-68584?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721020826-2d069dce84a2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68584 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-68584?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68584: SiYuan password-protected document bypass via content API endpoints

Q: Is there a fix for CVE-2026-68584?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721020826-2d069dce84a2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-68584 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-68584?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68584 · Severity: high · CVSS 8.6 · Published 2026-09-03

SiYuan is a note-taking and knowledge management application with a publish mode that allows users to share documents with password protection. Multiple content-fetching API endpoints fail to enforce the password requirement, allowing an unauthenticated attacker to retrieve the full contents of password-protected documents through alternate API calls. An attacker can discover internal document block IDs from publicly-listed (but password-protected) documents and use those IDs to fetch full content without providing a password, completely defeating the document-level access control.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-68584 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68584 being exploited in the wild.
How severe is CVE-2026-68584?: High severity, with a CVSS score of 8.6, published 3 September 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260721020826-2d069dce84a2, SEMVER:introduced=0,fixed=0.0.0-20260721020826-2d069dce84a2; SiYuan < 0.0.0-20260721020826-2d069dce84a2.
Is there a fix for CVE-2026-68584?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721020826-2d069dce84a2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68584 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-68584?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721020826-2d069dce84a2 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721020826-2d069dce84a2
```

Technical details

The vulnerability is an authentication bypass (CWE-288) in SiYuan's publish-mode password enforcement. The primary content endpoint (getDoc) correctly enforces password checks via FilterContentByPublishAccess, but six other content-returning endpoints perform only basic authentication checks (CheckAuth) without invoking the password filter. These endpoints convert block IDs into rendered DOM content regardless of the containing document's protected status. The bypass is reachable because protected documents are intentionally publicly listed, so an attacker obtains the document root ID. Internal heading/block IDs are then leaked from the searchEmbedBlock endpoint, which filters content but retains block IDs in its response. An attacker can then call getHeadingChildrenDOM with a leaked block ID to retrieve the full rendered content of the protected document without a password. The attack has been reproduced end-to-end on live instances and requires no authentication, user interaction, or special privileges.

Affected products

siyuan-note SiYuan < 0.0.0-20260721020826-2d069dce84a2

Identifiers

CVE-2026-68584
GHSA-7j72-f6wg-cxw6
GO-2026-6382

Timeline

2026-09-03: disclosed: Published to GitHub Advisory Database
2026-07-21: patched: Patch available in version 0.0.0-20260721020826-2d069dce84a2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.