Executive brief
SiYuan is a note-taking and knowledge management application. The /api/ref/refreshBacklink endpoint lacks proper authorization checks, allowing unauthenticated users or readers in publish mode to trigger server-side database writes and reference reindexing operations. An attacker can bypass read-only protections and perform resource amplification attacks without authentication.
Technical details
The vulnerability is a missing authorization (CWE-862) in the /api/ref/refreshBacklink POST endpoint. The handler is gated by CheckAuth only, which admits RoleReader tokens and anonymous accounts in publish mode when auth is disabled, but lacks the CheckAdminRole, CheckReadonly, or inline IsReadOnlyRoleContext guards present in sibling write handlers. An unauthenticated attacker can invoke the endpoint with a caller-controlled block ID to trigger RefreshBacklink(), which flushes the pending write-transaction queue to disk, performs a global reference scan (QueryRefsByDefID), loads and parses referencing trees from disk, and enqueues database write updates—all without consulting the workspace's global read-only flag. The handler performs no per-object authorization check on the attacker-supplied ID, enabling cross-scope reindexing of unpublished or access-restricted documents. Attack vector is network, requires no authentication or user interaction, and allows an unauthenticated DoS primitive through resource exhaustion and integrity bypass of read-only invariants. The vulnerability was patched in version v3.7.4.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-07-23: disclosed: Original advisory GHSA-wgwx-479j-23vq published
- 2026-08-14: advisory: Duplicate advisory GHSA-ww86-c2qf-w8fw published
- 2026-07-23: patched: Patched in version v3.7.4