CVE-2026-68586

SiYuan before v3.7.3 is affected by a bug where the content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc do not apply publish-access filters. Although the related backlink list endpoints filter publish-forbidden documents, the content endpoints are gated only by CheckAuth, all...

PT-2026-67401

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description An authentication bypass exists in publish mode where specific content-returning endpoints do not perform password checks, even though the primary getDoc endpoint is protected. Anonymous attackers can...