Executive brief
SiYuan is a note-taking application that supports a publish mode to share documents with readers. Administrators can mark documents as publish-forbidden to restrict access. However, certain API endpoints fail to enforce these access restrictions, allowing readers to retrieve the full rendered content of forbidden documents and probe whether they contain references to specific blocks. This undermines the confidentiality boundaries that administrators explicitly configure.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints. These content-delivery endpoints are gated only by CheckAuth and do not apply the FilterPathsByPublishAccess filter that their sibling list endpoints (getBacklink, getBacklink2) correctly enforce. As a result, an unauthenticated reader in publish mode (when Publish.Auth.Enable is false) or any publish RoleReader can call these endpoints directly with a publish-forbidden document's refTreeID and a known block defID to retrieve the rendered DOM of that document's backlinks, defeating the publish boundary. Additionally, the response reveals whether the forbidden document references the given block (a reference-existence oracle). No CSRF token, admin role, or write permissions are required. The fix is to apply the same publish-access filtering logic used in the list endpoints to the content endpoints.
Affected products
- SiYuan SiYuan before 3.7.3
Timeline
- 2026-08-03: disclosed: Advisory GHSA-2mmh-4rf8-7xg6 published
- 2026: patched: Fixed in v3.7.3