CVE-2026-68586 describes a missing authorization check in SiYuan note-taking software before version 3.7.3. Specifically, the API endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc fail to apply publish-access filters, allowing unauthorized users to retrieve rendered DOM content of publish-forbidden documents. While backlink list endpoints correctly filter out restricted documents, these content endpoints rely only on a basic CheckAuth gate, which does not prevent access by publish-mode readers or anonymous users if Basic Auth is disabled. This results in an information disclosure vulnerability with a CVSS 4.0 base score of 9.2 (critical).

Unauthorized users can access the rendered content of documents that should be restricted, potentially exposing sensitive information. Additionally, attackers can determine whether a document references a specific block, acting as a reference-existence oracle. This compromises confidentiality and may aid further targeted attacks or information gathering. There is no indication of privilege escalation or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to SiYuan version 3.7.3 or later once available, as the vulnerability is fixed in that version. Until then, consider enabling Basic Auth to restrict anonymous access and monitor access to the affected endpoints. Avoid exposing the affected API endpoints to untrusted networks.