CVE-2026-68584 describes an authentication bypass vulnerability in SiYuan note-taking software prior to version 3.7.3. The vulnerability occurs because several content-returning endpoints in publish mode do not perform password verification, while the primary document retrieval endpoint does. Attackers can exploit this by obtaining internal block IDs from endpoints accessible without authentication and then calling unprotected endpoints to retrieve the full content of password-protected documents, effectively bypassing the password protection mechanism.

An attacker without any privileges or authentication can retrieve the full content of documents that are supposed to be password-protected. This compromises the confidentiality of sensitive information stored in SiYuan documents. The vulnerability has a high attack vector (network), requires no privileges or user interaction, and results in high confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, users should consider restricting access to the affected endpoints or disabling publish mode if feasible to reduce exposure.