CVE-2026-72812

SiYuan has a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint for versions before v3.7.4. The issue allows anonymous readers to trigger persistent server-side writes by supplying an attacker-controlled block ID, which can flush transaction queues, scan all references g...