Duplicate Advisory: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-69mh-gvh4-8gp7. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction,...

CVE-2026-68584: Authentication Bypass Using an Alternate Path or Channel

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...