Executive brief
SiYuan is a local-first note-taking application that supports publish mode to share content selectively. Two API endpoints—getBacklinkDoc and getBackmentionDoc—return the rendered content of notes marked as publish-forbidden to anonymous readers or publish-mode users when authentication is disabled. This bypasses administrator-configured access controls and discloses private note content that should remain hidden.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two backlink API endpoints. The list endpoints (getBacklink, getBacklink2) correctly apply a FilterPathsByPublishAccess filter before returning document paths, but the content endpoints (getBacklinkDoc, getBackmentionDoc) omit this check and return rendered HTML blocks (Backlink.DOM) from any document if called with a valid refTreeID and defID. Both endpoints are gated by CheckAuth only, making them reachable to anonymous users when Publish.Auth.Enable is false or to any publish RoleReader token. An attacker must supply refTreeID (the forbidden document ID) and defID (a block it references); if the forbidden document references any public content, defID is discoverable and only refTreeID need be supplied. No admin role, CSRF token, or write permission is required. Impact is confidentiality-only; no data modification is possible. The fix requires applying the same publish-access filtering logic from getBacklink/getBacklink2 to the content endpoints, including CheckPathAccessableByPublishIgnore and publish-password cookie checks.
Affected products
- SiYuan SiYuan before 0.0.0-20260721014413-f45749a7ef6e
Timeline
- 2026-09-03: disclosed: GitHub Advisory GHSA-36v8-mpjm-8j5r published
- 2026-07-21: patched: Patched version 0.0.0-20260721014413-f45749a7ef6e released