{"uuid": "1a084001-d5c4-4087-9c1b-024768f44205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-69mh-gvh4-8gp7", "type": "seen", "source": "https://gist.github.com/alon710/9e58c194a5866f9cf4591587a2bfc382", "content": "# CVE-2026-68587: CVE-2026-68587: Broken Access Control in SiYuan Note Transaction Endpoints\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68587\n\n## Summary\nCVE-2026-68587 is a critical authorization bypass vulnerability in SiYuan, an open-source personal knowledge management workspace. When deployed in publish mode, specific transaction endpoints fail to perform administrative role validation. This omission enables unauthenticated remote readers to retrieve the rendered Document Object Model (DOM) of publish-disabled (private) documents by supplying a target heading block identifier. Upgrading to version v3.7.3 or later resolves this issue by applying appropriate routing middleware constraints.\n\n## TL;DR\nAn unauthenticated remote information disclosure vulnerability exists in SiYuan Note versions prior to v3.7.3. Due to missing authorization checks in the heading transaction endpoints, an attacker can access the rendered content of private documents by targeting their block IDs. The vulnerability has been resolved by enforcing administrative authorization checks on the affected API routes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Vulnerability Type**: Missing Authorization\n- **CVSS v4.0 Score**: 9.2\n- **Attack Vector**: Network\n- **Exploit Maturity**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note\n- **siyuan**: < v3.7.3 (Fixed in: `v3.7.3`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.3 or later\n- Disable Publish Mode if public reading access is not required\n- Deploy reverse proxy or WAF rules to restrict access to affected transaction endpoints\n\n**Remediation Steps:**\n1. Identify the version of SiYuan Note currently running in the environment\n2. Obtain version v3.7.3 or a newer release from the official repository\n3. Apply the update according to the deployment guidelines (Docker, local package, or server binaries)\n4. If immediate patching is impossible, modify your Nginx, Apache, or WAF configuration to block external access to `/api/block/getHeadingLevelTransaction`, `/api/block/getHeadingDeleteTransaction`, and `/api/block/getHeadingInsertTransaction`\n5. Verify the remediation by sending a test request to the transaction endpoints and ensuring a 403 Forbidden response is returned\n\n## References\n\n- [GitHub Security Advisory GHSA-69mh-gvh4-8gp7](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-69mh-gvh4-8gp7)\n- [Fix Commit 69db783](https://github.com/siyuan-note/siyuan/commit/69db783b782aea865ea70a1c5ab656e5c0f3dadb)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getheading-transaction)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-68587)\n- [NVD Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-68587)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68587) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T15:31:59.439834Z"}