CVE-2026-68584 describes an authentication bypass vulnerability in SiYuan note-taking software prior to version 3.7.3. In publish mode, endpoints such as getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc do not perform password verification, unlike the primary getDoc endpoint. Attackers can retrieve internal block IDs from reader-accessible endpoints and use these to call unprotected content endpoints, thereby bypassing password protection and accessing full document content without authentication.

The vulnerability allows unauthenticated attackers to access the full content of password-protected documents, compromising confidentiality. This can lead to unauthorized disclosure of sensitive information stored in SiYuan notes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until then, restrict access to the affected SiYuan versions and consider disabling publish mode if feasible.