Is CVE-2026-68587 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68587 being exploited in the wild.

How severe is CVE-2026-68587?

High severity, with a CVSS score of 8.6, published 3 September 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260721013353-69db783b782a, SEMVER:introduced=0,fixed=0.0.0-20260721013353-69db783b782a; SiYuan before 0.0.0-20260721013353-69db783b782a.

Is there a fix for CVE-2026-68587?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721013353-69db783b782a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68587 attacked?

It is attacked over the network.

Am I affected by CVE-2026-68587?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68587: SiYuan getHeading*Transaction authorization bypass in publish mode

Q: Is there a fix for CVE-2026-68587?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721013353-69db783b782a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-68587 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-68587?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68587 · Severity: high · CVSS 8.6 · Published 2026-09-03

SiYuan is a note-taking and knowledge management application that supports publishing documents with granular access controls. Three API endpoints (`getHeadingDeleteTransaction`, `getHeadingLevelTransaction`, `getHeadingInsertTransaction`) return rendered document content without checking whether the document is marked publish-disabled by an administrator, allowing anonymous readers or low-privileged accounts to view sensitive content that should be hidden. An attacker who knows a heading's block ID can bypass content restrictions and read full document text from documents explicitly marked as not publishable.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-68587 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68587 being exploited in the wild.
How severe is CVE-2026-68587?: High severity, with a CVSS score of 8.6, published 3 September 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260721013353-69db783b782a, SEMVER:introduced=0,fixed=0.0.0-20260721013353-69db783b782a; SiYuan before 0.0.0-20260721013353-69db783b782a.
Is there a fix for CVE-2026-68587?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721013353-69db783b782a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68587 attacked?: It is attacked over the network.
Am I affected by CVE-2026-68587?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721013353-69db783b782a or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721013353-69db783b782a
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in three heading transaction endpoints. These endpoints (`/api/block/getHeadingDeleteTransaction`, `/api/block/getHeadingLevelTransaction`, `/api/block/getHeadingInsertTransaction`) are gated only by `CheckAuth`, which permits both anonymous readers and RoleReader tokens in publish mode. Despite their mutation-implying names, these endpoints compute but do not execute transactions; they return rendered DOM of the heading subtree in the transaction payload without invoking the publish-access filter (`IsReadOnlyRoleContext`) that the reader-safe content path (`getDoc`) applies. An attacker with a heading block ID can extract full rendered HTML content from documents marked publish-disabled, defeating administrator-configured access boundaries. The precondition is knowledge of the target heading's block ID; when chained with other CheckAuth-only endpoints lacking publish-access filters, this enables end-to-end disclosure of publish-disabled documents. No write privilege, admin role, or CSRF token is required. Patched in version 0.0.0-20260721013353-69db783b782a.

Affected products

SiYuan SiYuan before 0.0.0-20260721013353-69db783b782a

Identifiers

CVE-2026-68587
GHSA-69mh-gvh4-8gp7
GO-2026-6381

Timeline

2026-09-03: disclosed: GitHub Advisory GHSA-69mh-gvh4-8gp7 published
2026-07-21: patched: Fix released in version 0.0.0-20260721013353-69db783b782a (commit 69db783)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.